BGP path attributes // RFC 4271
BGP is a TCP application with a tiny fixed header and a large, flag-driven type-length-value space. The four high bits of each attribute flag octet decide whether a speaker must understand it, whether it survives a hop, and how long the length field is.
01Message & UPDATE layout
marker · length · typeEvery BGP message starts with a 16-byte Marker (all ones in BGP-4), a 16-bit Length including the header, and an 8-bit Type. The default maximum length is 4096 bytes; RFC 8654 adds an extended message capability for larger updates.
| Type | Message | Reference | Body |
|---|---|---|---|
1 | OPEN | RFC 4271 §4.2 | Version, AS, hold time, identifier, optional parameters. |
2 | UPDATE | RFC 4271 §4.3 | Withdrawn routes, path attributes, NLRI. |
3 | NOTIFICATION | RFC 4271 §4.5 | Error code, subcode, diagnostic data. |
4 | KEEPALIVE | RFC 4271 §4.4 | Header only; 19 bytes total. |
5 | ROUTE-REFRESH | RFC 2918 | AFI and SAFI for a route refresh request. |
Withdrawn Routes Length (2 bytes) scopes the withdrawn prefix list. Total Path Attribute Length (2 bytes) scopes the attribute list. Whatever remains after those regions is NLRI. An empty UPDATE with no withdrawn routes and no attributes is a valid keepalive-like advertisement of nothing.
02Attribute flags
one octet that changes everythingThe first octet of every path attribute is a flag field. Optional means a speaker that does not understand the attribute may ignore it. Transitive means the attribute should be passed on. Partial marks an optional transitive attribute that a speaker did not fully understand. Extended Length switches the length field from one byte to two.
0xC0
The low four bits are reserved and must be zero. Partial is only meaningful for optional transitive attributes; for well-known attributes it must be clear. Extended Length may be set even when the value is short, but it is unusual.
Attribute header · normal length
Attribute header · extended length
AS_PATH segment
AS_PATH is a list of segments. The segment length counts AS numbers, not bytes, so the total byte length depends on the negotiated AS width.
COMMUNITIES value layout
Standard communities are two 16-bit halves: an AS number and a local value. Extended communities add a type and subtype; large communities use three 32-bit words.
Well-known attributes have Optional=0 and Transitive=1. Optional non-transitive attributes have Optional=1 and Transitive=0. Optional transitive attributes have both. A Partial bit on a well-known attribute is a protocol error under RFC 4271; RFC 7606 tightened the handling of malformed attributes.
03Attribute types
the ones that matter at 03:00Click a row to load its standard flags into the editor above. Values on the wire are big-endian; the AS width is not encoded in AS_PATH and must be known from the session capability.
| Code | Attribute | Standard flags | Value | RFC | Notes |
|---|---|---|---|---|---|
1 | ORIGIN | 0x40 | 1 byte: 0 IGP, 1 EGP, 2 INCOMPLETE | 4271 §5.1 | Well-known mandatory. |
2 | AS_PATH | 0x40 | segments of ASNs | 4271 §5.1.2 | Well-known mandatory; 2- or 4-byte ASNs by capability. |
3 | NEXT_HOP | 0x40 | 4-byte IPv4 address | 4271 §5.1.3 | Well-known mandatory for IPv4 unicast. |
4 | MULTI_EXIT_DISC | 0x80 | 4-byte integer | 4271 §5.1.4 | Optional non-transitive; the MED. |
5 | LOCAL_PREF | 0x40 | 4-byte integer | 4271 §5.1.5 | Well-known discretionary; iBGP only. |
6 | ATOMIC_AGGREGATE | 0x40 | zero bytes | 4271 §5.1.6 | Well-known discretionary. |
7 | AGGREGATOR | 0xC0 | AS + IPv4 address | 4271 §5.1.7 | Optional transitive; RFC 6793 changes AS width. |
8 | COMMUNITIES | 0xC0 | 4 bytes per community | RFC 1997 | Optional transitive; well-known values use AS 65535. |
9 | ORIGINATOR_ID | 0x80 | 4-byte router ID | RFC 4456 | Optional non-transitive; route reflection. |
10 | CLUSTER_LIST | 0x80 | 4-byte cluster IDs | RFC 4456 | Optional non-transitive; loop prevention. |
14 | MP_REACH_NLRI | 0x80 | AFI, SAFI, next hop, NLRI | RFC 4760 | Optional non-transitive; IPv6, VPN, EVPN. |
15 | MP_UNREACH_NLRI | 0x80 | AFI, SAFI, withdrawn NLRI | RFC 4760 | Optional non-transitive. |
16 | EXTENDED_COMMUNITIES | 0xC0 | 8 bytes per community | RFC 4360 · 5668 | Optional transitive; route targets and origins. |
17 | AS4_PATH | 0xC0 | segments of 4-byte ASNs | RFC 6793 | Optional transitive; compatibility with 2-byte peers. |
18 | AS4_AGGREGATOR | 0xC0 | 4-byte AS + IPv4 | RFC 6793 | Optional transitive. |
32 | LARGE_COMMUNITIES | 0xC0 | 12 bytes per community | RFC 8092 | Optional transitive; global:local1:local2. |
NO_EXPORT = 0xFFFFFF01 · NO_ADVERTISE =
0xFFFFFF02 · NO_EXPORT_SUBCONFED = 0xFFFFFF03 ·
NO_PEER = 0xFFFFFF04. In the AS:value notation these are
65535:65281 through 65535:65284.
04Attribute encoder
one path attributeBuild a single path attribute with standard flags, automatic length selection and a type-specific value parser. This is the attribute, not the whole UPDATE message; the decoder below accepts either and can show the envelope.
attribute parameters
3+ value bytesFlags are set to the standard values for the selected type. Changing them is allowed; the decoder will flag inconsistencies.
attribute bytes
waitingno bytes built yet
The decoder accepts one or more concatenated path attributes, a complete UPDATE body, or a full BGP message with the all-ones marker. AS_PATH width must be supplied because the wire format does not carry it.
05Decoder
attributes · UPDATE · full messagePaste bytes from a pcap, a lab session or the encoder. A full BGP message is detected by its 16-byte all-ones marker. Raw input is parsed as a sequence of path attributes. The AS width selector applies to AS_PATH and AGGREGATOR; AS4_PATH is always 4-byte.
parse bytes
RFC 4271 · RFC 7606 validationAS_PATH and AGGREGATOR width follows the session capability. AS4_PATH is always 4-byte.
06Wire notes
where BGP parsers and routers disagreeAS_PATH carries a sequence of AS numbers but no width byte. A session that negotiated four-octet AS support uses 4-byte ASNs; an old session uses 2-byte ASNs and may carry AS4_PATH alongside. Parsing with the wrong width silently shifts every subsequent segment.
- Marker is all ones. BGP-4 expects 16 bytes of 0xff. Authentication mechanisms historically changed it; modern BGP uses TCP-MD5/TCP-AO at the transport layer.
- Length includes the 19-byte header. The default maximum message size is 4096 bytes; extended messages (RFC 8654) can reach 65535 with capability negotiation.
- Attribute length is bytes, not elements. Communities are 4 bytes each; extended communities 8; large communities 12. A length not divisible by the element size is a parse error.
- Segment length is AS count. For AS_PATH, the second byte of a segment counts ASNs, not bytes. Multiply by the AS width when walking the value.
- Partial means “I did not understand this”. It is only valid on optional transitive attributes and should make the receiver forward the attribute even though it ignored the semantics.
- RFC 7606 changed error handling. Many malformed attributes are now treated as withdraw-with-error rather than session reset. Do not assume an old “treat-as-withdraw” path.
- Path attributes are policy, not truth. ORIGIN, AS_PATH, MED and communities are inputs to decision processes; RPKI and route-leak detection live outside the attribute encoding.