0

I'm trying to parse the BGP trace downloaded here. It is said that the BGP packet traces are stored in the files with prefix updates and these MRT format files can be read by PyBGPdump.

I downloaded one file and followed the instruction (or this better formatted one):

cnt = 0
dump = pybgpdump.BGPDump('sample.dump.gz')
for mrt_h, bgp_h, bgp_m in dump:
    cnt += 1
print cnt, 'BGP messages in the MRT dump'

However, I got this error:

Traceback (most recent call last):
  File "bgp-stats.py", line 8, in <module>
    for mrt_h, bgp_h, bgp_m in dump:
  File "/usr/local/lib/python2.7/dist-packages/pybgpdump.py", line 61, in next
    bgp_m = dpkt.bgp.BGP(bgp_h.data)
  File "/usr/local/lib/python2.7/dist-packages/dpkt/dpkt.py", line 89, in __init__
    self.unpack(args[0])
  File "/usr/local/lib/python2.7/dist-packages/dpkt/bgp.py", line 152, in unpack
    self.data = self.update = self.Update(self.data)
  File "/usr/local/lib/python2.7/dist-packages/dpkt/dpkt.py", line 89, in __init__
    self.unpack(args[0])
  File "/usr/local/lib/python2.7/dist-packages/dpkt/bgp.py", line 247, in unpack
    attr = self.Attribute(self.data)
  File "/usr/local/lib/python2.7/dist-packages/dpkt/dpkt.py", line 89, in __init__
    self.unpack(args[0])
  File "/usr/local/lib/python2.7/dist-packages/dpkt/bgp.py", line 326, in unpack
    self.data = self.as_path = self.ASPath(self.data)
  File "/usr/local/lib/python2.7/dist-packages/dpkt/dpkt.py", line 89, in __init__
    self.unpack(args[0])
  File "/usr/local/lib/python2.7/dist-packages/dpkt/bgp.py", line 376, in unpack
    seg = self.ASPathSegment(self.data)
  File "/usr/local/lib/python2.7/dist-packages/dpkt/dpkt.py", line 94, in __init__
    (self.__class__.__name__, args[0]))
dpkt.dpkt.UnpackError: invalid ASPathSegment: '\x1d\xf6\x00\x00\x1d\xf6\x00\x00\x1d\xf6\x00\x00F\xe0'

It seems to be a format issue. I searched for "sample.dump.gz" and found it here. The result is just fine:

(999, 'BGP messages in the MRT dump')

Any insights what happens here? All trace files are not readable and I have no idea how to parse the files from the repo I found.

Many thanks!

4

1 回答 1

1

这是当前 dpkt 库中的一个错误。官方存储库中有一个未解决的问题，但它来自 2015 年。问题是 BGP 更新解析器将 AS 路径中的 AS 编号视为 2 个八位字节/字节的 AS 编号，即使它们被编码为 4 个八位字节/字节AS 编号。因此，当它到达长度为 2 的 4 字节编码 AS 路径的开头时

\x00\x00\xab\xcd   \x00\x00\x12\x34

它会尝试读取两个 2 字节的 AS 编号然后停止。因此，43981 4660它不会读取0 43981并解释错误的剩余字节。

目前没有快速解决方案，因为问题非常棘手。为了了解 AS 路径是如何编码的，必须查看在 BGP Open 消息中协商的功能。不确定其他解析器如何处理这个问题。

您可以在 repo 中解决问题或尝试使用类似mrtparse的替代库。

于 2019-08-26T13:04:34.977 回答