networking routing ai_generated true

BGP Notification: Hold Timer Expired (code 4, subcode 0)

ID: networking/bgp-peer-down

Also available as: JSON · Markdown
82%Fix Rate
85%Confidence
40Evidence
2023-01-01First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
any active — — —

Root Cause

The BGP session with a peer has gone down, typically because keepalive messages were not received before the hold timer expired. This results in route withdrawal and potential traffic blackholing until the session is re-established.

generic

Workarounds

  1. 85% success Investigate and resolve the underlying cause of keepalive loss 
    1. Check interface status: ip link show
2. Check for interface errors/drops: ethtool -S eth0 | grep -i error
3. Verify BGP daemon CPU usage: top -p $(pgrep bgpd)
4. Check system logs for OOM or kernel errors: dmesg | tail -50
5. Verify MTU matches on both ends of the peering link
6. Check for CRC errors or link flaps on the physical interface
7. If CPU-bound, enable BFD for faster failure detection instead of relying solely on BGP keepalives
  2. 88% success Enable BFD (Bidirectional Forwarding Detection) for faster failover 
    1. Configure BFD on both peers with sub-second timers
2. In FRRouting: neighbor X.X.X.X bfd
3. Verify BFD session: show bfd peers
4. BFD detects link failure in milliseconds rather than waiting for the BGP hold timer (default 90s)
5. This allows traffic to reconverge via alternate paths much faster

Dead Ends

Common approaches that don't work:

  1. Simply clear the BGP session repeatedly without investigating the underlying cause 80% fail

    Clearing the BGP session forces a re-establishment, but if the root cause (interface flap, MTU mismatch, CPU overload dropping keepalives) persists, the session will drop again after the hold timer expires.

  2. Increase the hold timer to very large values to mask the problem 70% fail

    While a longer hold timer delays detection, it also means convergence takes much longer when a genuine failure occurs, and the underlying keepalive loss still indicates a real issue like congestion or CPU starvation.

Error Chain

Leads to:
Preceded by:
Frequently confused with: