SGT CCIE

We all know BGP uses TCP port 179 to establish peerings, and exchange updates- but which device is the TCP server and which is the TCP client? Here’s the diagram we’re going to be use. There is some irrelevant information in it, but I’ll be using the same diagram in an upcoming article, so it works out.

All we really need to focus on here, is the peering relationship, so you can immediately ignore the AS numbers, but pay attention to the interface names so that our debugging makes sense. Below you’ll find the base configs:

R1
interface Serial0/1
 ip address 10.25.1.2 255.255.255.0

R3
interface Serial1/2
 ip address 10.25.1.3 255.255.255.0
 clock rate 64000

Assuming we’ve checked for reachability (we always do, right?) prior to implementing our BGP config, let’s move on. I’m going to config R1 (see below for config), then do the same on R2. While implementing the config on R2, I’ll run a debug on R1 and you can see the results below:

R1
router bgp 100
 no synchronization
 bgp log-neighbor-changes
 neighbor 10.25.1.3 remote-as 300
 no auto-summary

R1#debug ip tcp transactions

Now we’ll configure R3 while the debug runs on R1:

R3
 router bgp 300
 no synchronization
 bgp log-neighbor-changes
 neighbor 10.25.1.2 remote-as 100
 no auto-summary

 We’ll hop back over to R1 and check our debug

//R3 initiaties the TCP 3-way handshake with a SYN (R3 is the client)
*Mar  1 02:52:08.611: IP: s=10.25.1.3 (Serial0/1), d=10.25.1.2, len 44, rcvd 0
*Mar  1 02:52:08.611:     TCP src=61865, dst=179, seq=974881862, ack=0, win=1638
4 SYN

//R1 responds with a TCP SYN ACK (R1 is the TCP server)
*Mar  1 02:52:08.615: IP: s=10.25.1.2 (local), d=10.25.1.3 (Serial0/1), len 44,
sending
*Mar  1 02:52:08.615:     TCP src=179, dst=61865, seq=485018988, ack=974881863,
win=16384 ACK SYN

//R3 responds with a SYN ACK, completing the 3-way handshake
*Mar  1 02:52:08.631: IP: s=10.25.1.3 (Serial0/1), d=10.25.1.2, len 40, rcvd 0
*Mar  1 02:52:08.635:     TCP src=61865, dst=179, seq=974881863, ack=485018989,
win=16384 ACK

Pretty straightforward. Now what happens if we change the IP address of R1′s S0/1 interface from .2 to .100- making it higher than R3′s? Let’s see:

//This time, R1 initiatiates the connection
*Mar  1 02:59:43.621: IP: s=10.25.1.100 (local), d=10.25.1.3 (Serial0/1), len 44
, sending
*Mar  1 02:59:43.621:     TCP src=20475, dst=179, seq=648606915, ack=0, win=1638
4 SYN
*Mar  1 02:59:43.641: IP: tableid=0, s=10.25.1.3 (Serial0/1), d=10.25.1.100 (Ser
ial0/1), routed via RIB

//R3 is now the TCP server, and responds with a SYN ACK
*Mar  1 02:59:43.641: IP: s=10.25.1.3 (Serial0/1), d=10.25.1.100 (Serial0/1), le
n 44, rcvd 3
*Mar  1 02:59:43.645:     TCP src=179, dst=20475, seq=58783282, ack=648606916, w
in=16384 ACK SYN