Help with decoding BGP version 3 & 4.

[Tony Li <[e-mail]>]

Hi,

I think you're going to have real problems because the version number
is only exchanged at peer initialization time, which is the start of
the TCP connection.  

We'd love to have you correctly sniff out BGP packets but it's hard to
believe that you're going to be able to extract coherent BGP messages
from the TCP stream.

Data can be had by flipping me an image that I can boot on my remote
sniffer in the lab that decodes BGP.  ;-)

Tony

   I work at Network General Corp., the Sniffer company and am in the
   protocol interpreter group. I'm current working on upgrading BGP
   version 2 decodes to versions 3 & 4 but have run into a problem.

   Open, Update and Notification types have changed from the original
   version 2.  Since we should be able to decode all three versions I
   have to be able to tell which one is which by looking at the packet.
   `Open' is easy since it has the version number as a parameter but the
   other two types, Update and Notification are almost impossible to
   figure out. I was wondering if someone out there has run into a
   similar problem and could assist me.

   Some trace files would also be helpful as I am working out of the
   RFC's and haven't seen any real BGP traffic data yet.

   Thanks,

   Sennen.
   [e-mail]