You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I looked into this issue: the BMP blocker seems to be fixed upstream.
BIRD 3.3.3 / 3.2.4 / 3.1.9 (released Oct 2) include two BMP fixes: Fix route sending when no import table is configured (BIRD #463) and Fix crash on sending routes (BIRD #429).
I built a small reproducible bench: a BIRD peer acting as a route server, a router under test with the BMP block and ImportFilter from ixpcdg01 (import table on + import keep filtered, IPv4 and IPv6), and a minimal BMP station. The peer announces RPKI valid / invalid / not-found prefixes, then withdraws two of them. Expected: 6 prefixes pre-policy, 4 post-policy, then correct withdrawals.
Results:
2.16.1: OK
3.2.0: session up, no route exported over BMP (reproduces the RIB-In issue)
3.2.0 + fix-bmp-adj-rib-in: routes are exported, but the RPKI-rejected routes also appear as post-policy, and bird is no longer running a few seconds after the withdrawals
3.3.2: crash when sending routes (Assertion 'b->my_id' failed, attrs.c)
3.3.3: OK, same pre/post content and withdrawals as 2.16.1
Same results on aarch64 and x86_64, over several runs.
One difference: 3.3.3 sends duplicate announcements (24 to 33 BMP messages depending on the run, vs 21 for 2.16.1), at session start and ~1 s later in post-policy for RPKI-valid prefixes. The final state is identical, and risotto's curation should drop them, but I haven't checked it on the real pipeline.
All 7 rendered configs parse with 3.3.3; only vlt warns about password without authentication md5;.
To be clear, this only shows that the BMP blocker seems fixed upstream. It doesn't validate 3.3.3 for production (no risotto, no full table, short runs); that would need a staged rollout.
I migrated some nodes but it seems Bird 3.3.3 consumes about twice as much memory than 2.16 for the same configuration. Unfortunately some servers are a bit tight in memory at the moment.
It seems that the memory increase is due to the way Bird 3 is dealing with ROA table in a multithreaded way. SInce most servers in NXTHDR only run IPv6, we can save memory by just dropping the ROA v4 table.
Activity
matthieugouel commentedon Apr 16, 2025
I experienced issue with BMP on v3.0 so for now I'm gonna wait.
matthieugouel commentedon Feb 8, 2026
Main issue being BMP RIB IN not working anymore. The fix is here matthieugouel/bird@835ea3f but needs to be merged into the codebase.
Saber-Omari commentedon Oct 14, 2026
Hi Matthieu,
I looked into this issue: the BMP blocker seems to be fixed upstream.
BIRD 3.3.3 / 3.2.4 / 3.1.9 (released Oct 2) include two BMP fixes: Fix route sending when no import table is configured (BIRD #463) and Fix crash on sending routes (BIRD #429).
I built a small reproducible bench: a BIRD peer acting as a route server, a router under test with the BMP block and
ImportFilterfromixpcdg01(import table on+import keep filtered, IPv4 and IPv6), and a minimal BMP station. The peer announces RPKI valid / invalid / not-found prefixes, then withdraws two of them. Expected: 6 prefixes pre-policy, 4 post-policy, then correct withdrawals.Results:
2.16.1: OK
3.2.0: session up, no route exported over BMP (reproduces the RIB-In issue)
3.2.0 +
fix-bmp-adj-rib-in: routes are exported, but the RPKI-rejected routes also appear as post-policy, and bird is no longer running a few seconds after the withdrawals3.3.2: crash when sending routes (
Assertion 'b->my_id' failed, attrs.c)3.3.3: OK, same pre/post content and withdrawals as 2.16.1
Same results on aarch64 and x86_64, over several runs.
One difference: 3.3.3 sends duplicate announcements (24 to 33 BMP messages depending on the run, vs 21 for 2.16.1), at session start and ~1 s later in post-policy for RPKI-valid prefixes. The final state is identical, and risotto's curation should drop them, but I haven't checked it on the real pipeline.
All 7 rendered configs parse with 3.3.3; only
vltwarns aboutpasswordwithoutauthentication md5;.To be clear, this only shows that the BMP blocker seems fixed upstream. It doesn't validate 3.3.3 for production (no risotto, no full table, short runs); that would need a staged rollout.
Bench, results and reproduction steps: https://github.com/Saber-Omari/bird3-bmp-bench
If useful, I'd be happy to open a PR (
bird_version→ 3.3.3 and thevltfix).How would you prefer to roll it out, maybe one IXP router first?
Saber
matthieugouel commentedon Oct 26, 2026
Thank you very much @Saber-Omari for your analysis, and sorry for the response delay!
I've installed Bird 3.3.3 on one of the the IXP servers (ixpcdg01) and I'm going to monitor it for a day before deploying everywhere.
matthieugouel commentedon Oct 27, 2026
I migrated some nodes but it seems Bird 3.3.3 consumes about twice as much memory than 2.16 for the same configuration. Unfortunately some servers are a bit tight in memory at the moment.
matthieugouel commentedon Oct 27, 2026
It seems that the memory increase is due to the way Bird 3 is dealing with ROA table in a multithreaded way. SInce most servers in NXTHDR only run IPv6, we can save memory by just dropping the ROA v4 table.
feat(install-bird): move to BIRD 3.3.3
feat(install-bird): move to BIRD 3.3.3
matthieugouel commentedon Oct 27, 2026
I updated most of the servers, beside the ones that are running an experiment right now. Once again, thanks for your contribution @Saber-Omari !