Blog Home | INE Home | Members | Contact Us | Subscribe

Free Resources View Archives All Access Pass CCIE Bloggers

06 Understanding BGP Regular Expressions

Jan Search
Posted by Brian McGahan, CCIE #8593, CCDE #2013::13 in BGP,BGP 29 Comments Search

Hi Brian, Submit

Can you explain the easiest way to construct a regular expression in BGP? Tw eet
Categories

Thanks, Select Category

Rowan

Hi Rowan,

Regular expressions are strings of special characters that can be used to search and find character patterns.
Within the scope of BGP in Cisco IOS regular expressions can be used in show commands and AS-Path access-
lists to match BGP prefixes based on the information contained in their AS-Path.

In order to understand how to build regular expressions we first need to know what the character definitions are for
the regex function of IOS. The below table illustrates the regex characters and their usage. This information is
contained in the Cisco IOS documentation under the Appendix of Cisco IOS Terminal Services Configuration
Guide, Release 12.2.

+------------------------------------------------------+
| CHAR | USAGE |
+------------------------------------------------------|
| ^ | Start of string |
|------|-----------------------------------------------|
| $ | End of string |
|------|-----------------------------------------------|
| [] | Range of characters |
|------|-----------------------------------------------|
| - | Used to specify range ( i.e. [0-9] ) |
|------|-----------------------------------------------|
| ( ) | Logical grouping |
|------|-----------------------------------------------|
| . | Any single character |
|------|-----------------------------------------------|
| * | Zero or more instances |
|------|-----------------------------------------------|
| + | One or more instance |
|------|-----------------------------------------------|
| ? | Zero or one instance |
|------|-----------------------------------------------|
| _ | Comma, open or close brace, open or close |
| | parentheses, start or end of string, or space |
+------------------------------------------------------+

Some commonly used regular expressions include:

+-------------+---------------------------+
| Expression | Meaning |
|-------------+---------------------------|
CCIE Bloggers
| .* | Anything | Brian Dennis CCIE #2210
|-------------+---------------------------| Routing & Sw itching
| ^$ | Locally originated routes | ISP Dial
|-------------+---------------------------| Security
Service Provider
| ^100_ | Learned from AS 100 |
Voice
|-------------+---------------------------|
Brian McGahan CCIE #8593
| _100$ | Originated in AS 100 |
Routing & Sw itching
|-------------+---------------------------| Security
| _100_ | Any instance of AS 100 | Service Provider
|-------------+---------------------------| Petr Lapukhov CCIE #16379
| ^[0-9]+$ | Directly connected ASes | Routing & Sw itching
+-------------+---------------------------+ Security
Service Provider
Voice
Let’s break some of the above expressions down step-by-step. The first one “.*” says to match any single
Mark Snow CCIE #14073
character (“.”), and then find zero or more instances of that single character (“*”). This means zero or more
Voice
instances or any character, which effectively means anything. Security

The next string “^$” says to match the beginning of the string (“^”), and then immediately match the end of the
string (“$”). This means that the string is null. Within the scope of BGP the only time that the AS-Path is null is
Popular Posts
when you are looking at a route within your own AS that you or one of your iBGP peers has originated. Hence this OSPF Virtual Link Issue - First to
matches locally originated routes. answ er w ins iPad Mini

CCIE Voice to become CCIE

The next string “^100_” says to match the beginning of the string (“^”), the literal characters 100, and then a
Collaboration in November 2013!
comma, an open or close brace, an open or close, a parentheses, the start or end of the string, or a space (“_”).
This means that the string must start with the number 100 followed by any non-alphanumeric character. In the CCIE Security Version 4

scope of BGP this means that routes which are learned from the AS 100 will be matched, as 100 will be the first AS Technology Labs and Solutions -

in the path when AS 100 is sending us routes. Now Available!

The next string “_100$” is the exact opposite of the previous one. This string says to start with any non-
alphanumeric character (“_”), followed by the literal characters 100, followed by the end of the string (“$”). This
means that AS 100 is the last AS in the path, or in other words that the prefix in question was originated by AS
100.

The next string “_100_” is the combination of the two previous strings with some extra matches. This string means
that the literal characters 100 are set between any two non-alphanumeric characters. The first of these could be
the start of the string, which would match routes learned from AS 100, while the second of these could be the end
of the string, which would match routes originated in AS 100. Another case could be that the underscores
represent spaces, in which the string would match any other AS path information as long as “ 100 ” is included
somewhere. This would match any routes which transit AS 100, and therefore “_ASN_” is generally meant to match
routes that transit a particular AS as defined by the number “ASN”.

The final string “^[0-9]+$” is a little more complicated match. Immediately we can see that the string starts (“^”), and
we can see later that it ends (“$”). In the middle we see a range of numbers 0-9 in brackets, followed by the plus
sign. The numbers in brackets mean that any number from zero to nine can be matched, or in other words, any
number. Next we have the plus sign which means one or more instances. This string “[0-9]+” therefore means one
or more instance of any number, or in other words any number including numbers with multiple characters (i.e. 1,
12, 123, 1234, 12345678, etc.). When we combine these all together this string means routes originated in any
directly connected single AS, or in other words, the routes directly originated by the peers of your AS.

Now let’s look at a more complicated match, and using the above character patterns we will see how we can
construct the expression step by step. Suppose we have the following topology below, where we are looking at the
network from the perspective of AS 100.

+--------+ +--------+ +--------+ +--------+

| AS 200 |-| AS 201 |-| AS 202 |-| AS 203 |\
+--------+ +--------+ +--------+ +--------+ \
\
+--------+ +--------+ +--------+\ \
| AS 300 |-| AS 301 |-| AS 302 | \ \
+--------+ +--------+ +--------+ \ -+--------+
>--| AS 100 |
+--------+ +--------+ / -+--------+
| AS 400 |-| AS 401 | / /
+--------+ +--------+/ /
/
+--------+ /
| AS 500 |/
+--------+

AS 100 peers with ASes 203, 302, 401, and 500, who each have peers as diagramed above. AS 100 wants to
match routes originated from its directly connected customers (ASes 203, 302, 401, and 500) in addition to routes
originated from their directly connected customers (ASes 202, 301, and 400). The easiest way to create this
regular expression would be to think about what we are first trying to match, and then write out all possibilities of
these matches. In our case these possibilities are:

203
203 202
302
302 301
401
401 400
500

Now we could simply create an expression with multiple lines (7 lines to be exact) that would match all of the
possible AS paths, but suppose that AS 100 wants to keep this match as flexible as possible so that it will apply to
any other ASes in the future. Now let’s try to generalize the above AS-Path information into a regex.

First off we know that each of the matches is going to start and going to end. This means that the first character
we will have is “^” and the last character is “$”. Next we know that between the “^” and “$” there will be either one
AS or two ASes. We don’t necessarily know what numbers these ASes will be, so for the time being let’s use the
placeholder “X”. Based on this our new possible matches are:

^X$
^X X$

Next let’s reason out what X can represent. Since X is only one single AS, there will be no spaces, commas,
parentheses, or any other special type characters. In other words, X must be a number. However, since we don’t
know what the exact path is, we must take into account that X may be a number with more than one character (i.e.
10, 123, or 10101). This essentially equates to one or more instance of any number zero through nine. In regular
expression syntax our two matches would therefore now read:

^[0-9]+$
^[0-9]+ [0-9]+$

This expressions reads that we either have a number consisting of one or more characters zero through nine, or a
number consisting of one or more characters zero through nine followed by a space and then another number
consisting of one or more characters zero through nine. This brings our expression down to two lines as opposed
to our original seven, but let’s see how we can combine the above two as well. To combine them, first let us
compare what is different between them.

^[0-9]+$
^[0-9]+ [0-9]+$

From looking at the expressions it is evident that the sequence “ [0-9]+” is the difference. In the first case “ [0-9]+”
does not exist in the expression. In the second case “ [0-9]+” does exist in the expression. In other words, “ [0-9]+”
is either true or false. True or false (0 or 1) is represented by the character “?” in regex syntax. Therefore we can
reduce our expression to:

^[0-9]+ [0-9]+?$

At this point we run into a problem with the order of operations of the regex. As denoted above the question mark
will apply only to the plus sign, and not to the range [0-9]. Instead, we want the question mark to apply to the string
“ [0-9]+” as a whole. Therefore this string needs to be grouped together using parentheses. Parentheses are used
in regular expressions as simply a logical grouping. Therefore our final expression reduces to:

^[0-9]+( [0-9]+)?$

Note that to match a question mark in IOS, the escape sequence CTRL-V or ESC-Q must be entered first,
otherwise the IOS parser will interpret the question mark as an attempt to invoke the context sensitive help.

Tags: as-path, filtering, regexp

Download this page as a PDF

About Brian McGahan, CCIE #8593, CCDE #2013::13:

Brian McGahan w as one of the youngest engineers in the w orld to obtain the CCIE, having achieved his first CCIE in
Routing & Sw itching at the age of 20 in 2002. Brian has been teaching and developing CCIE training courses for over 8
years, and has assisted thousands of engineers in obtaining their CCIE certification. When not teaching or developing
new products Brian consults w ith large ISPs and enterprise customers in the midw est region of the United States.
Find all posts by Brian McGahan, CCIE #8593, CCDE #2013::13 | Visit Website

You can leave a response, or trackback from your own site.

29 Responses to “Understanding BGP Regular Expressions”

January 7, 2008 at 4:28 am

shef

And what we should do with 2-byte AS’s?

Thanks.

Reply

January 8, 2008 at 1:52 pm

Brian McGahan, CCIE 8593

What is an example case of this?

Reply

January 9, 2008 at 12:16 am

shef

yes.

2-byte AS have dot: 65000.65000 for example. Dot in regexp – any single character

Reply

January 9, 2008 at 6:30 pm

Brian McGahan, CCIE 8593

You need to escape the dot with a backslash. You could say 65000\.65000

Reply

May 6, 2008 at 2:03 am

Nizami

hi Brian. i have a question.how to match on AS and all its directly connected customers with taking into consideration the future
growth.
what is the difference between theese regular expressions? Say we have AS 100.

^100(_[0-9]+)?$
and

^100_[0-9]*$
will result be the same?

Reply

June 10, 2008 at 8:30 am

Brian McGahan, CCIE #8593

It should match the same thing. Test it on a route server to be 100% sure.

Reply

October 22, 2008 at 2:41 pm

Matching on AS Path Prepend information. « A Networker Blog

[...] is a nice article wrote by Brian McGahan about Regular Expression Possibly related posts: (automatically generated)HTTP/1.1
Pipelining « [...]

Reply

December 2, 2008 at 9:42 pm

Harpreet Singh

Sharing another good link for regular expression:-

http://www.juniper.net/techpubs/software/erx/junose61/swconfig-routing-vol1/html/routing-policy-config11.html

See the table at bottom of the page..

regards
Harpreet Singh

Reply

Oc tober 15, 2011 at 10:09 pm

Mukul

Right Explanation

Reply

June 12, 2009 at 5:17 am

BGP Expression List @ JonZu Groups

[...] List Posted in June 6, 2009 ¬ 1:05 amh.adminNo Comments » Easy AdSense by
Unrealhttp://blog.internetworkexpert.com/2008/01/06/understanding-bgp-regular-expressions/ Thanking [...]

Reply

August 20, 2010 at 4:21 am

miodragpro

Great explanations…
Thanks

Reply

September 28, 2010 at 8:00 am

noobie7

Fabulous post!

Reply

December 5, 2010 at 11:48 am

examguy

thanks for detailed explanation

Reply

December 16, 2010 at 9:27 am

How to manipulate BGP Routes - part 2 - The Journey of a Network Engineer

[...] did a good job explaining the regex in his blog. Please refer it to get more examples and how to use these expressions to match
AS_PATH [...]

Reply

January 29, 2011 at 2:56 am

Kamran

Nice post Brian. This will help me understand BGP regex.

Thanks a lot..!

Reply

January 30, 2011 at 5:25 am

Smith

Hi Brian,

Can you please explain what the below line indicates:

seq 10 permit reg-exp 64514:11[1267].3

PS: The config is not from Cisco

Thanks in Advance

Reply

July 2, 2011 at 10:52 pm

harry

Great article dude

Reply

August 6, 2011 at 3:02 pm

Ayyappan

Hey Brian,

The Regex in your result ‘^[0-9]+( [0-9]+)?$’ did not include a character representing a space between the 2 ASes for eg: the space
between ’203 202′. Why is this so ?

See Nizami has included this. But there as well

^100_[0-9]*$ picks for instance 100 200 and not any more ASes.
while ^100(_[0-9]+)?$ can pick 100 200 and 100 200 300 ….

Reply

August 9, 2011 at 7:29 pm

Brian McGahan, CCIE #8593

The space is in the string.

Reply

August 6, 2011 at 3:09 pm

Ayyappan

^[0-9]+( [0-9]+)?$ seem to represent a varying length of single AS match ???

Reply

August 9, 2011 at 7:28 pm

Brian McGahan, CCIE #8593

That would be a list of either 1 or 2 ASes exactly.

Reply

Dec ember 16, 2011 at 11:17 am

Dom

Thanks for the detailed explanation =]

Reply

April 28, 2012 at 11:54 pm

Ganesh V

Thanks for your clear explanation. Before referring this I was fearing on how to learn this regular expressions.

Reply

July 17, 2012 at 8:59 am

Eugene Uy

Great explanation!

Reply

December 11, 2012 at 8:12 pm

rewan

gr8 post!!!

Reply

January 22, 2013 at 3:35 am

Eugene

Hi, Dennis!
May i ask you a question concerning regular expressions in BGP?
What regular expression should be used to display only BGP routes on which as path prepending was done, say, more than 20
times (by the same AS)?
The question was born after reading the article: http://www.renesys.com/blog/2009/02/longer-is-not-better.shtml.
The task is to find whether there are such suspicious internet routes, on which some ISP executed as-path prepending procedure
unusually many times.

I thought that _([0-9]+)(_\1){20,} would work (repeat delimiter and backreference 20 or more times), but public route server @ Optus,
Australia, said otherwise:

*********************************************************************************

route-views.optus.net.au>sh ip bgp reg _([0-9]+)(_\1){3,}

route-views.optus.net.au>

*********************************************************************************

- actually, nothing. That is, even at least triple prepending is not discovered, although the standard expression _([0-9]+)(_\1)+ works
fine:

*********************************************************************************
route-views.optus.net.au>sh ip bgp reg _([0-9]+)(_\1)+
BGP table version is 150012938, local router ID is 203.202.125.6
Status codes: s suppressed, d damped, h history, * valid, > best, i – internal,
r RIB-failure, S Stale, m multipath, b backup-path, x best-external
Origin codes: i – IGP, e – EGP, ? – incomplete

Network Next Hop Metric LocPrf Weight Path

*> 1.0.4.0/22 202.160.242.71 0 7473 6453 7545 7545 7545 56203 i
* 203.13.132.49 20 0 7474 7545 7545 7545 7545 7545 56203 i
* 203.13.132.47 10 0 7474 7545 7545 7545 7545 7545 56203 i
* 202.139.124.175 1 0 7474 7545 7545 7545 7545 7545 56203 i
* 202.139.124.145 10 0 7474 7545 7545 7545 7545 7545 56203 i
* 202.139.124.130 20 0 7474 7545 7545 7545 7545 7545 56203 i
* 202.139.124.159 0 7474 7545 7545 7545 7545 7545 56203 i
* 203.13.132.51 20 0 7474 7545 7545 7545 7545 7545 56203 i
* 202.139.124.177 1 0 7474 7545 7545 7545 7545 7545 56203 i
* 192.65.89.98 20 0 7474 7545 7545 7545 7545 7545 56203 i
* 192.65.89.161 1 0 7474 7545 7545 7545 7545 7545 56203 i
*************************************************************************************

Best regards, Eugene Smirnov. CCSI #32361

Reply

January 23, 2013 at 10:35 am

Brian McGahan, CCIE #8593

I don’t think IOS regex supports { } You could just keep repeating the (_\1) but there is a limit to the depth it will accept:

route-server.ams2>$show ip bgp regex _([0-9]+)(_\1)(_\1)(_\1)(_\1)(_\1)(_\1)(_\1)(_\1)(_\1)

% too many ()
% Invalid regular expression

Reply

January 22, 2013 at 3:36 am

Eugene

Sorry, Brian, of course!

Reply

May 6, 2013 at 1:49 am

Regular Expressions in IOS | The IT Networking Alliance

[...] Some time ago INE has posted a very explanatory post about Regular Expressions in BGP [...]

Reply

Leave a Reply

Name (required)

Mail (will not be published) (required)

Submit Comment

twitter.com/inetraining

© 2011 INE, Inc., All Rights Reserved

pdfcrowd.com