Courseiva
DebugPrivileged EXEC

debug ip bgp updates

Use this command to monitor BGP update messages in real-time for troubleshooting route advertisement and withdrawal issues.

Syntax·Privileged EXEC
debug ip bgp updates

When to Use This Command

  • Troubleshooting why a specific prefix is not being advertised to a BGP neighbor
  • Verifying that route updates are being sent and received correctly after a BGP policy change
  • Diagnosing BGP session flapping caused by update errors
  • Monitoring BGP updates during a network migration or maintenance window

Command Examples

Monitor all BGP updates

debug ip bgp updates
BGP(0): 192.168.1.1 rcvd UPDATE w/ attr: nexthop 10.0.0.1, origin i, metric 0, path 65001
BGP(0): 192.168.1.1 rcvd 10.1.1.0/24
BGP(0): 192.168.1.1 rcvd UPDATE w/ attr: nexthop 10.0.0.1, origin i, metric 0, path 65001
BGP(0): 192.168.1.1 rcvd 10.1.2.0/24
BGP(0): 192.168.1.1 rcvd UPDATE w/ attr: nexthop 10.0.0.1, origin i, metric 0, path 65001 65002
BGP(0): 192.168.1.1 rcvd 10.1.3.0/24
BGP(0): 192.168.1.1 rcvd UPDATE w/ attr: nexthop 10.0.0.1, origin i, metric 0, path 65001
BGP(0): 192.168.1.1 rcvd 10.1.4.0/24

Each line shows a received update from neighbor 192.168.1.1. 'rcvd UPDATE w/ attr' indicates the attributes: nexthop, origin, metric, and AS_PATH. The following line shows the prefix being advertised. Multiple prefixes may be grouped under one UPDATE message.

Monitor updates with neighbor filter

debug ip bgp updates 10.0.0.1
BGP(0): 10.0.0.1 rcvd UPDATE w/ attr: nexthop 192.168.1.1, origin i, metric 0, path 65001
BGP(0): 10.0.0.1 rcvd 172.16.0.0/16
BGP(0): 10.0.0.1 rcvd UPDATE w/ attr: nexthop 192.168.1.1, origin i, metric 0, path 65001
BGP(0): 10.0.0.1 rcvd 172.16.1.0/24

This filters debug output to only show updates from neighbor 10.0.0.1. Useful when monitoring a specific peer. The output format is identical to the unfiltered version.

Understanding the Output

The debug output shows each BGP update message received or sent. Lines starting with 'BGP(0):' indicate the BGP process (0 is default). The neighbor IP follows. 'rcvd' means received, 'sent' means transmitted. 'UPDATE w/ attr' shows the path attributes: nexthop (next-hop IP), origin (i=IGP, e=EGP, ?=incomplete), metric (MED), and path (AS_PATH). Subsequent lines list the prefixes included in that update. A single UPDATE can carry multiple prefixes. If you see 'UPDATE w/ attr: withdrawn' it means routes are being withdrawn. Good output shows expected prefixes being advertised/received. Bad signs include unexpected withdrawals, attribute changes, or error messages like 'invalid ORIGIN' or 'malformed attribute'.

CCNA Exam Tips

1.

Remember that 'debug ip bgp updates' is a privileged EXEC command and can generate heavy output on a production router; always use with caution.

2.

The exam may test that you can filter debug output by neighbor IP to reduce CPU impact.

3.

Know that BGP updates contain NLRI (prefixes) and path attributes; the debug shows both.

4.

Be aware that 'undebug all' or 'no debug ip bgp updates' is needed to stop debugging.

Common Mistakes

Leaving debug enabled on a production router, causing high CPU usage and potential crashes.

Confusing 'debug ip bgp updates' with 'debug ip bgp events' which shows session state changes, not route updates.

Forgetting to specify a neighbor IP when only interested in one peer, leading to overwhelming output.

Related Commands

show ip bgp

Displays the BGP routing table, showing learned BGP routes and their attributes, used for troubleshooting BGP path selection and verifying route advertisement.

show ip bgp neighbors

Displays detailed information about BGP neighbor sessions, including state, timers, and advertised/received prefixes, used to verify BGP peering and troubleshoot neighbor relationships.

Practice for the CCNA 200-301

Test your knowledge with hundreds of CCNA practice questions covering all exam domains.

Practice CCNA Questions