BGP message types

Message header

Every BGP message starts with a 19-octet fixed header.

Field	Length	Description
Marker	16 octets	All ones (0xFF). Historical authentication hook, now compatibility only.
Length	2 octets	Total message length including header. Range: 19–4096.
Type	1 octet	1=OPEN, 2=UPDATE, 3=NOTIFICATION, 4=KEEPALIVE

The smallest valid message is a KEEPALIVE at exactly 19 octets (header only, no payload).

OPEN

Sent immediately after TCP connection establishment. Each side sends one OPEN; receipt of a valid OPEN is confirmed by a KEEPALIVE.

Field	Length	Description
Version	1 octet	Protocol version (4)
My AS	2 octets	Sender’s AS number (2-octet; 4-octet via RFC 6793 capability)
Hold Time	2 octets	Proposed hold timer in seconds. Must be 0 or >= 3.
BGP Identifier	4 octets	Router ID — a unique IPv4 address assigned to the speaker
Opt Parm Len	1 octet	Length of Optional Parameters field
Optional Parameters	variable	Capability advertisements (RFC 5492)

The negotiated Hold Time is the minimum of the two peers’ proposed values. If zero, neither side sends keepalives.

Capabilities

Optional Parameters carry capabilities (type 2 per RFC 5492). Common capabilities:

Capability	Code	Purpose
Multiprotocol Extensions	1	IPv6, VPNv4, EVPN address families
Route Refresh	2	Request full re-advertisement
4-octet AS	65	Support AS numbers > 65535
Graceful Restart	64	Maintain forwarding during restart
Enhanced Route Refresh	70	Bounded route refresh with ORF
Extended Message	6	Messages up to 65535 octets

UPDATE

Carries routing information — both route advertisements and withdrawals. A single UPDATE advertises at most one set of path attributes but may include multiple NLRI prefixes sharing those attributes.

Field	Description
Withdrawn Routes Length	2 octets. 0 means no withdrawals in this message.
Withdrawn Routes	List of <length, prefix> tuples being withdrawn
Total Path Attribute Length	2 octets. 0 means no NLRI and no attributes.
Path Attributes	Variable-length sequence of TLV-encoded attributes
NLRI	List of <length, prefix> tuples being advertised

Each prefix is encoded as a 1-octet bit-length followed by the minimum octets needed to hold that many bits. A /24 takes 4 octets (1 length + 3 prefix). A /0 (default route) takes 1 octet (length=0, no prefix bytes).

UPDATE semantics

• Advertising a prefix with new attributes implicitly replaces the previous advertisement for that prefix.
• A message may carry only withdrawals (no attributes, no NLRI).
• A message may carry only advertisements (Withdrawn Routes Length = 0).
• The same prefix in both Withdrawn Routes and NLRI is treated as an advertisement (withdrawal is ignored).

KEEPALIVE

Header-only message (19 octets). Sent at intervals not exceeding one-third the negotiated Hold Time. Resets the peer’s Hold Timer upon receipt.

Keepalives serve dual duty:

1. Confirm the OPEN (first KEEPALIVE after OPEN exchange)
2. Detect peer liveness during the session

If Hold Time is 0, keepalives are never sent and the Hold Timer never expires.

NOTIFICATION

Signals a fatal error. The BGP connection closes immediately after sending.

Field	Length	Description
Error Code	1 octet	Category of error
Error Subcode	1 octet	Specific error within category
Data	variable	Diagnostic payload (depends on code/subcode)

Error Code	Name	Typical trigger
1	Message Header Error	Bad marker, length, or type
2	OPEN Message Error	Version mismatch, bad AS, bad ID, bad hold time
3	UPDATE Message Error	Malformed attributes, missing mandatory attributes
4	Hold Timer Expired	No KEEPALIVE/UPDATE within Hold Time
5	FSM Error	Unexpected event in current state
6	Cease	Administrative shutdown, prefix limit exceeded

See BGP error handling for full subcode tables and revised error handling (RFC 7606).

Message flow example