BGP Fault Finder

Deep BGP diagnostic: neighbor state analysis, flap detection, prefix count anomalies, route reflector topology verification, AS-path policy violations, and MED/LOCAL_PREF inconsistencies.

Cisco IOS/XE/XR

Juniper

Arista

Open in Generator Open in Platform

You're viewing a preview

The full script, parameters, and execution console are available with a free account.

Already have access? Sign in →

Capabilities

BGP neighbor state matrix
Flap history & MTBF calc
Prefix count drift detection
Route reflector client mapping
AS-path regex violation scan
MED/LP policy audit
NEXT_HOP reachability check

Required inputs

Parameters the script accepts. Defaults shown; some are vendor- or context-gated.

Parameter	Type	Default	Notes
Flap threshold (mins) flap_threshold_mins	number	60	—
Prefix drift alert (%) prefix_drift_pct	number	10	—
Verify RR topology check_rr	bool	true	Route-reflector topology probes require Cisco IOS/XR — auto-disabled for the selected vendor mix.
AS-path policy regex as_path_regex	string	^65[0-9]{3}$	AS-path policy audit only runs when RR topology verification is on.
Alert webhook URL alert_webhook	string	—	—

Hint 1 — Narrow to a specific peer

Run bgp_fault only against edge routers where uptime < 1h. Filter inventory by role=edge in devices.csv.

Hint 2 — Integrate with RCA

Run this after a BGP flap alert. Open findings in the RCA engine with the timestamp from the alert to auto-correlate.

Hint 3 — Automate baseline saving

Run once per week in --save-baseline mode to keep the prefix drift comparison current. Add to cron: 0 2 * * 1.

Hint 4 — Multi-vendor inventory

Set vendor=junos in devices.csv — the script auto-switches to Juniper parsers. Mix vendors in one CSV run.

Sample inventory schema

Authoritative shape of the device/policy data this script consumes.

devices.csv

csv

16 routers across LON1/FRA1/NYC1/SIN1 — multi-vendor with RR roles

terminal

hostname,mgmt_ip,site,role,vendor,os,asn,bgp_router_id,loopback,rr_role,maintenance,ssh_port
core-rtr-01,10.10.0.11,LON1,core,cisco,iosxr-7.9.2,65000,10.255.0.11,10.255.0.11/32,server,false,22
core-rtr-02,10.10.0.12,LON1,core,cisco,iosxr-7.9.2,65000,10.255.0.12,10.255.0.12/32,server,false,22
core-rtr-03,10.10.0.13,FRA1,core,cisco,iosxr-7.9.2,65000,10.255.0.13,10.255.0.13/32,server,false,22

bgp_peers.yaml

yaml

eBGP transit + IXP/PNI peerings with MD5 vault refs and max-prefix

yaml

# eBGP transit + IXP peerings (operator-owned ASN 65000)
peers:
  - device: edge-rtr-01
    neighbor: 192.0.2.1

Expected output

Reference terminal output the script should produce — used as a stylistic and structural target.

terminal

[2025-05-13 14:22:01] INFO  Starting BGP fault analysis across 47 devices...

╔══════════════════════════════════════════════════════════╗
║              BGP NEIGHBOR STATE MATRIX                  ║
╠══════════════╦════════════╦═══════════╦════════════╦════╣
║ Device       ║ Neighbor   ║ State     ║ Uptime     ║ #PFX║
╠══════════════╬════════════╬═══════════╬════════════╬════╣
║ core-rtr-01  ║ 10.0.0.2   ║ Established║ 14d 06h   ║ 847 ║
║ core-rtr-01  ║ 10.0.0.6   ║ IDLE      ║ 00:03:14  ║  0  ║ ← CRITICAL
║ core-rtr-02  ║ 10.0.0.1   ║ Established║ 14d 06h   ║ 847 ║