BGP Message Types

The four messages every BGP session is built from — OPEN, UPDATE, KEEPALIVE, NOTIFICATION. Go past 'BGP works': dissect each packet field by field, see why KEEPALIVE runs at hold-time/3, and learn what a NOTIFICATION code 6/3 actually tells you at 3am. Validated against FRRouting's bgpd/bgp_packet.c.

Launch Simulator →

What you'll explore

  1. 01

    Message Overview

    Every BGP message shares a 19-byte header — a 16-byte marker, a 2-byte length, and a 1-byte type. Four type codes carry the entire protocol.

  2. 02

    OPEN Message

    Sent once TCP is established. Carries Version, My AS, Hold Time, BGP Identifier, and Optional Parameters (capabilities) — the parameters both peers must agree on before the session comes up.

  3. 03

    UPDATE Message

    The workhorse. Carries Withdrawn Routes, Path Attributes (ORIGIN, AS_PATH, NEXT_HOP, LOCAL_PREF, MED), and NLRI — the prefixes being advertised.

  4. 04

    NOTIFICATION Message

    The error message. Carries a major Error Code and a subcode, then the session is torn down. Reading the code/subcode tells you exactly why a peer dropped.

  5. 05

    KEEPALIVE Message

    19 bytes — just the header, no payload. The smallest legal BGP message. Sent every hold-time/3 to prove the session is still alive.

Validated against FRRouting frr-10.6.1 — bgpd/bgp_packet.c and friends. Every simulated behavior cites a real source function, and a server-side correlation engine computes how each layer's state cascades into the next. See the methodology →

This module is part of zerohop Pro — it unlocks alongside the full kata library, progress tracking, and weak-area analysis.

Launch Simulator →