BGP COMMUNITY Attribute

What COMMUNITY Is

COMMUNITY is a path attribute that carries a tag along with a route (BGP Path Attributes and Best Path Selection). It has no effect on best path selection by itself; it means something only when a router that sees the tag acts on it through its own policy.

Item	Value
Type code	8
Attribute class	Optional Transitive
Value	32 bits (4 octets) per community; several can be carried together
Notation	`AS:value` (upper 16 bits : lower 16 bits)
Reserved ranges	`0x00000000`–`0x0000FFFF` and `0xFFFF0000`–`0xFFFFFFFF`
Best path selection	No effect. It only tags the route
Definition	RFC 1997 BGP Communities Attribute (Standards Track)

Being Optional Transitive, a router that does not understand the community passes it on: a tag set by AS 65004 travels through AS 65001 and reaches AS 65002.

The `AS:value` Notation

The 32 bits are split into two 16-bit halves and written as 65004:1000. For values outside the reserved ranges RFC 1997 says the upper half shall be encoded with an AS number, and that AS defines the meaning of the lower half. Using the AS number as a namespace keeps tags from colliding. Because the upper half is only 16 bits, a 4-byte AS number does not fit; Large Communities, below, solve that.

Tagging and Acting on Tags Are Two Different ASes

Two roles always pair up.

Role	What it does	Typical party
Tagger	Attaches a tag with `set community` and advertises the route	Customer, downstream AS
Actor	Matches the tag on receipt with `community matches-any`, then changes `LOCAL_PREF` or narrows where the route is advertised	Upstream ISP

If the actor does nothing, the tag simply rides along. When an upstream ISP publishes “tag your route with this community and we will treat it this way,” customers control routing themselves. A user-defined community carries no force of its own. Its meaning is decided by the receiving AS, so it behaves as advertised only when every border router in that AS carries the same match.

A Real Example: NTT (AS2914)

An excerpt from the communities NTT’s Global IP Network (AS2914) publishes in its Routing Policies:

Community	Meaning
`2914:429`	do not advertise to any peers
`2914:421`–`2914:423`	prepend the AS_PATH 1–3 times toward all peers
`2914:490`	customer default (LOCAL_PREF 120)
`2914:450`	peer fallback (LOCAL_PREF 96)
`65500:nnn`	do not announce to peer AS `nnn`
`2914:666`	blackhole (discard traffic toward the prefix)

A customer attaches one of these to control the LOCAL_PREF inside AS2914 or which peers see the route. STEP 8 reproduces 2914:429 in the lab as 65001:429.

Well-Known Communities

RFC 1997 defines three values with the same meaning in every AS (in the reserved range starting 0xFFFF).

Name	Hex	What RFC 1997 says
`NO_EXPORT`	`0xFFFFFF01`	MUST NOT be advertised outside a BGP confederation boundary
`NO_ADVERTISE`	`0xFFFFFF02`	MUST NOT be advertised to other BGP peers
`NO_EXPORT_SUBCONFED`	`0xFFFFFF03`	MUST NOT be advertised to external BGP peers (including peers in other member ASes inside a confederation)

Without confederations, NO_EXPORT means “do not send it to eBGP peers, but do distribute it over iBGP” and NO_ADVERTISE means “do not send it anywhere, iBGP included” (STEPs 6 and 7). Two more well-known communities were added later.

Name	Hex	`AS:value`	Definition
`GRACEFUL_SHUTDOWN`	`0xFFFF0000`	`65535:0`	RFC 8326 Graceful BGP Session Shutdown (Standards Track). Reduces packet loss during planned maintenance
`BLACKHOLE`	`0xFFFF029A`	`65535:666`	RFC 7999 BLACKHOLE Community (Informational). Asks a neighbouring network to discard traffic toward the prefix

Extended and Large Communities

There are two derivatives (not covered here).

Attribute	Type code	Length each	Structure	Definition
COMMUNITY	8	4 octets	16 bits + 16 bits	RFC 1997
Extended Community	16	8 octets	Type/Sub-Type + value. Used for MPLS-VPN Route Targets and similar	RFC 4360
Large Community	32	12 octets	Three 32-bit fields (Global Administrator + Local Data Part 1 and 2)	RFC 8092

Large Communities let a 4-byte AS number serve as the namespace, as in 64500:1:2.

Configuring Communities on IOS XR

They are handled in RPL (Routing Policy Language).

Tagging

route-policy TO-UPSTREAM
  if destination in (192.168.6.0/24) then
    set community (65004:1000)
  endif
  pass
end-policy

set community replaces whatever was already there; append additive to keep the existing communities (STEPs 3 and 4).

  set community (65001:100) additive

Matching

Define a set with community-set, then match with community matches-any (any one) or matches-every (all).

community-set CS-FROM-CUSTOMER
  65004:1000
end-set
!
route-policy FROM-CUSTOMER
  if community matches-any CS-FROM-CUSTOMER then
    set local-preference 200
  endif
  pass
end-policy

The match is evaluated against the value as it entered the policy. A set community in the same policy does not change the outcome of an if community matches-any.

Removing

  delete community all                  ! remove everything
  delete community in CS-FROM-CUSTOMER  ! remove only what the community-set lists

eBGP Needs `send-community-ebgp`

IOS XR sends communities to iBGP peers by default but not to eBGP peers; send-community-ebgp is required for eBGP.

router bgp 65004
 neighbor 10.1.6.1
  address-family ipv4 unicast
   send-community-ebgp
   route-policy TO-UPSTREAM out

show bgp neighbor reports Community attribute sent to this neighbor when it is in place.

Verification on Real Hardware

Six XRd 26.1.1 routers, in nine STEPs.

The COMMUNITY verification lab topology. R1 and R2 in AS 65001 peer eBGP with R4 in AS 65002, and R4 also peers with R5 in AS 65003. R5 peers with R6 in AS 65004, and R6 also peers with R1. R6 tags 192.168.6.0/24 with a community and advertises it to R1

AS	Router	Role
65001	R1, R2	AS border. iBGP full mesh with R3 (Loopback0, `next-hop-self`) plus OSPF area 0
65001	R3	Internal. No eBGP peers
65002	R4	eBGP with R1, R2 and R5
65003	R5	eBGP with R4 and R6. Advertises `192.168.5.0/24`
65004	R6	eBGP with R5 and R1. Advertises `192.168.6.0/24`

The prefix under observation is 192.168.6.0/24, originated by R6. It travels R6 → (eBGP) → R1 → (iBGP) → R2 and R3, and R1 → (eBGP) → R4, so one prefix shows how far a community travels.

STEP	Change	What to look for
0	No policy	No community attached
1	R6 adds `set community (65004:1000)`	The value arrives over eBGP and crosses iBGP to R2, R3 and R4
2	R1 raises `LOCAL_PREF 200` on `matches-any`	The acting side of the pair
3	R1 adds `set community (65001:100)` without `additive`	The original `65004:1000` disappears
4	Add `additive`	Both values are carried
5	R1 inbound back to `PASS-ALL`	Only the original value remains
6	R6 sets `NO_EXPORT`	R1 and R2 stop advertising to eBGP; iBGP still carries it
7	R6 sets `NO_ADVERTISE`	R1 stops advertising over iBGP too and withdraws from R2 and R3
8	R6 sets `65001:429`; R1 drops it in `TO-R4`	Advertisement control with a user-defined community

Every eBGP neighbour carries send-community-ebgp and a separately named outbound policy (TO-R1, TO-R4 and so on, containing only pass). Distinct names keep update-group membership fixed across the STEPs; each STEP edits only the contents of a policy.

STEP 0: Initial State

The 192.168.6.0/24 that R1 received.

R1 show bgp 192.168.6.0/24 (STEP 0)
RP/0/RP0/CPU0:R1#show bgp 192.168.6.0/24

Wed Sep  9 05:50:59.631 UTC
BGP routing table entry for 192.168.6.0/24
Versions:
  Process           bRIB/RIB   SendTblVer
  Speaker                  7            7
Last Modified: Sep  9 05:14:11.774 for 00:36:47
Paths: (1 available, best #1)
  Advertised IPv4 Unicast paths to update-groups (with more than one peer):
    0.2 
  Advertised IPv4 Unicast paths to peers (in unique update groups):
    10.1.4.4        
  Path #1: Received by speaker 0
  Advertised IPv4 Unicast paths to update-groups (with more than one peer):
    0.2 
  Advertised IPv4 Unicast paths to peers (in unique update groups):
    10.1.4.4        
  65004, (received & used)
    10.1.6.6 from 10.1.6.6 (10.0.0.6)
      Origin IGP, metric 0, localpref 100, valid, external, best, group-best
      Received Path ID 0, Local Path ID 1, version 7
      Origin-AS validity: (disabled)

There is no Community: line.

STEP 1: R6 Tags `192.168.6.0/24` with `65004:1000`

R6’s TO-R1 is rewritten.

R6 show rpl route-policy TO-R1 (STEP 1)
RP/0/RP0/CPU0:R6#show rpl route-policy TO-R1

Wed Sep  9 06:14:29.887 UTC
route-policy TO-R1
  if destination in (192.168.6.0/24) then
    set community (65004:1000)
  endif
  pass
end-policy
!

A Community: line now appears on R1.

R1 show bgp 192.168.6.0/24 (STEP 1)
RP/0/RP0/CPU0:R1#show bgp 192.168.6.0/24

Wed Sep  9 06:12:17.878 UTC
BGP routing table entry for 192.168.6.0/24
Versions:
  Process           bRIB/RIB   SendTblVer
  Speaker                  9            9
Last Modified: Sep  9 06:10:23.774 for 00:01:54
Paths: (1 available, best #1)
  Advertised IPv4 Unicast paths to update-groups (with more than one peer):
    0.2 
  Advertised IPv4 Unicast paths to peers (in unique update groups):
    10.1.4.4        
  Path #1: Received by speaker 0
  Advertised IPv4 Unicast paths to update-groups (with more than one peer):
    0.2 
  Advertised IPv4 Unicast paths to peers (in unique update groups):
    10.1.4.4        
  65004, (received & used)
    10.1.6.6 from 10.1.6.6 (10.0.0.6)
      Origin IGP, metric 0, localpref 100, valid, external, best, group-best
      Received Path ID 0, Local Path ID 1, version 9
      Community: 65004:1000
      Origin-AS validity: (disabled)

No.213 in the eBGP capture is the UPDATE from R6 to R1.

No.213 UPDATE (R6 to R1) tshark -V
Border Gateway Protocol - UPDATE Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 67
    Type: UPDATE Message (2)
    Withdrawn Routes Length: 0
    Total Path Attribute Length: 44
    Path attributes
        Path Attribute - MP_REACH_NLRI
            Flags: 0x90, Optional, Extended-Length, Non-transitive, Complete
<snip>
            Type Code: MP_REACH_NLRI (14)
            Length: 13
            Address family identifier (AFI): IPv4 (1)
            Subsequent address family identifier (SAFI): Unicast (1)
            Next hop: 10.1.6.6
                IPv4 Address: 10.1.6.6
            Number of Subnetwork points of attachment (SNPA): 0
            Network Layer Reachability Information (NLRI)
                192.168.6.0/24
                    MP Reach NLRI prefix length: 24
                    MP Reach NLRI IPv4 prefix: 192.168.6.0
        Path Attribute - ORIGIN: IGP
            Flags: 0x40, Transitive, Well-known, Complete
<snip>
            Type Code: ORIGIN (1)
            Length: 1
            Origin: IGP (0)
        Path Attribute - AS_PATH: 65004
            Flags: 0x40, Transitive, Well-known, Complete
<snip>
            Type Code: AS_PATH (2)
            Length: 6
            AS Path segment: 65004
                Segment type: AS_SEQUENCE (2)
                Segment length (number of ASN): 1
                AS4: 65004
        Path Attribute - MULTI_EXIT_DISC: 0
            Flags: 0x80, Optional, Non-transitive, Complete
<snip>
            Type Code: MULTI_EXIT_DISC (4)
            Length: 4
            Multiple exit discriminator: 0
        Path Attribute - COMMUNITIES: 65004:1000
            Flags: 0xc0, Optional, Transitive, Complete
<snip>
            Type Code: COMMUNITIES (8)
            Length: 4
            Communities: 65004:1000
                Community: 65004:1000
                    Community AS: 65004
                    Community value: 1000

Flags: 0xc0, Optional, Transitive marks it Optional Transitive.

Download the pcap of the packet in the tshark output above (No.213 UPDATE)

It Crosses the iBGP Hop

R1 passes the route to R2 and R3 over iBGP, and the value arrives unchanged.

R2 show bgp 192.168.6.0/24 (STEP 1)
RP/0/RP0/CPU0:R2#show bgp 192.168.6.0/24

Wed Sep  9 06:12:46.531 UTC
BGP routing table entry for 192.168.6.0/24
Versions:
  Process           bRIB/RIB   SendTblVer
  Speaker                  9            9
Last Modified: Sep  9 06:10:23.774 for 00:02:22
Paths: (1 available, best #1)
  Advertised IPv4 Unicast paths to peers (in unique update groups):
    10.2.4.4        
  Path #1: Received by speaker 0
  Advertised IPv4 Unicast paths to peers (in unique update groups):
    10.2.4.4        
  65004, (received & used)
    10.0.0.1 (metric 3) from 10.0.0.1 (10.0.0.1)
      Origin IGP, metric 0, localpref 100, valid, internal, best, group-best
      Received Path ID 0, Local Path ID 1, version 9
      Community: 65004:1000

No.427 in the iBGP capture is that UPDATE.

No.427 UPDATE in the iBGP capture (R1 to R3) tshark -V
Border Gateway Protocol - UPDATE Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 74
    Type: UPDATE Message (2)
    Withdrawn Routes Length: 0
    Total Path Attribute Length: 51
    Path attributes
        Path Attribute - MP_REACH_NLRI
            Flags: 0x90, Optional, Extended-Length, Non-transitive, Complete
<snip>
            Type Code: MP_REACH_NLRI (14)
            Length: 13
            Address family identifier (AFI): IPv4 (1)
            Subsequent address family identifier (SAFI): Unicast (1)
            Next hop: 10.0.0.1
                IPv4 Address: 10.0.0.1
            Number of Subnetwork points of attachment (SNPA): 0
            Network Layer Reachability Information (NLRI)
                192.168.6.0/24
                    MP Reach NLRI prefix length: 24
                    MP Reach NLRI IPv4 prefix: 192.168.6.0
        Path Attribute - ORIGIN: IGP
            Flags: 0x40, Transitive, Well-known, Complete
<snip>
            Type Code: ORIGIN (1)
            Length: 1
            Origin: IGP (0)
        Path Attribute - AS_PATH: 65004
            Flags: 0x40, Transitive, Well-known, Complete
<snip>
            Type Code: AS_PATH (2)
            Length: 6
            AS Path segment: 65004
                Segment type: AS_SEQUENCE (2)
                Segment length (number of ASN): 1
                AS4: 65004
        Path Attribute - MULTI_EXIT_DISC: 0
            Flags: 0x80, Optional, Non-transitive, Complete
<snip>
            Type Code: MULTI_EXIT_DISC (4)
            Length: 4
            Multiple exit discriminator: 0
        Path Attribute - LOCAL_PREF: 100
            Flags: 0x40, Transitive, Well-known, Complete
<snip>
            Type Code: LOCAL_PREF (5)
            Length: 4
            Local preference: 100
        Path Attribute - COMMUNITIES: 65004:1000
            Flags: 0xc0, Optional, Transitive, Complete
<snip>
            Type Code: COMMUNITIES (8)
            Length: 4
            Communities: 65004:1000
                Community: 65004:1000
                    Community AS: 65004
                    Community value: 1000

Download the pcap of the packet in the tshark output above (No.427 UPDATE)

R1 also advertises it to R4 over eBGP: a tag set by AS 65004 passes straight through AS 65001 and arrives in AS 65002.

R4 show bgp community 65004:1000 (STEP 1)
RP/0/RP0/CPU0:R4#show bgp community 65004:1000

Wed Sep  9 06:13:36.383 UTC
BGP router identifier 10.0.0.4, local AS number 65002
BGP generic scan interval 60 secs
Non-stop routing is enabled
BGP table state: Active
Table ID: 0xe0000000   RD version: 11
BGP main routing table version 11
BGP NSR Initial initsync version 4 (Reached)
BGP NSR/ISSU Sync-Group versions 0/0
BGP scan interval 60 secs

Status codes: s suppressed, d damped, h history, * valid, > best
              i - internal, r RIB-failure, S stale, N Nexthop-discard
Origin codes: i - IGP, e - EGP, ? - incomplete
   Network            Next Hop            Metric LocPrf Weight Path
*> 192.168.6.0/24     10.1.4.1                               0 65001 65004 i
*                     10.2.4.2                               0 65001 65004 i

Processed 1 prefixes, 2 paths

STEP 2: R1 Matches the Community and Raises `LOCAL_PREF`

Now R1 gets the configuration that acts on the tag.

R1 show rpl community-set CS-FROM-R6 (STEP 2)
RP/0/RP0/CPU0:R1#show rpl community-set CS-FROM-R6

Wed Sep  9 06:17:48.295 UTC
community-set CS-FROM-R6
  65004:1000
end-set
!

R1 show rpl route-policy FROM-R6 (STEP 2)
RP/0/RP0/CPU0:R1#show rpl route-policy FROM-R6

Wed Sep  9 06:17:48.790 UTC
route-policy FROM-R6
  if community matches-any CS-FROM-R6 then
    set local-preference 200
  endif
  pass
end-policy
!

Applied inbound on the neighbour towards R6, it makes localpref 200.

R1 show bgp 192.168.6.0/24 (STEP 2)
RP/0/RP0/CPU0:R1#show bgp 192.168.6.0/24

Wed Sep  9 06:17:43.938 UTC
BGP routing table entry for 192.168.6.0/24
Versions:
  Process           bRIB/RIB   SendTblVer
  Speaker                 10           10
Last Modified: Sep  9 06:17:31.774 for 00:00:12
Paths: (2 available, best #1)
  Advertised IPv4 Unicast paths to update-groups (with more than one peer):
    0.2 
  Advertised IPv4 Unicast paths to peers (in unique update groups):
    10.1.4.4        
  Path #1: Received by speaker 0
  Advertised IPv4 Unicast paths to update-groups (with more than one peer):
    0.2 
  Advertised IPv4 Unicast paths to peers (in unique update groups):
    10.1.4.4        
  65004
    10.1.6.6 from 10.1.6.6 (10.0.0.6)
      Origin IGP, metric 0, localpref 200, valid, external, best, group-best
      Received Path ID 0, Local Path ID 1, version 10
      Community: 65004:1000
      Origin-AS validity: (disabled)
  Path #2: Received by speaker 0
  Not advertised to any peer
  65004, (received-only)
    10.1.6.6 from 10.1.6.6 (10.0.0.6)
      Origin IGP, metric 0, localpref 100, valid, external
      Received Path ID 0, Local Path ID 0, version 0
      Community: 65004:1000
      Origin-AS validity: (disabled)

Path #2, (received-only), is the copy before the inbound policy (localpref 100); Path #1 is the post-policy result (localpref 200).

STEP 3: Without `additive`, `set community` Erases the Original

set community (65001:100) is added to FROM-R6 without additive.

R1 show rpl route-policy FROM-R6 (STEP 3)
RP/0/RP0/CPU0:R1#show rpl route-policy FROM-R6

Wed Sep  9 06:27:05.372 UTC
route-policy FROM-R6
  if community matches-any CS-FROM-R6 then
    set local-preference 200
  endif
  set community (65001:100)
  pass
end-policy
!

R1 show bgp 192.168.6.0/24 (STEP 3)
RP/0/RP0/CPU0:R1#show bgp 192.168.6.0/24

Wed Sep  9 06:26:59.651 UTC
BGP routing table entry for 192.168.6.0/24
Versions:
  Process           bRIB/RIB   SendTblVer
  Speaker                 12           12
Last Modified: Sep  9 06:26:26.774 for 00:00:32
Paths: (2 available, best #1)
  Advertised IPv4 Unicast paths to update-groups (with more than one peer):
    0.2 
  Advertised IPv4 Unicast paths to peers (in unique update groups):
    10.1.4.4        
  Path #1: Received by speaker 0
  Advertised IPv4 Unicast paths to update-groups (with more than one peer):
    0.2 
  Advertised IPv4 Unicast paths to peers (in unique update groups):
    10.1.4.4        
  65004
    10.1.6.6 from 10.1.6.6 (10.0.0.6)
      Origin IGP, metric 0, localpref 200, valid, external, best, group-best
      Received Path ID 0, Local Path ID 1, version 12
      Community: 65001:100
      Origin-AS validity: (disabled)
  Path #2: Received by speaker 0
  Not advertised to any peer
  65004, (received-only)
    10.1.6.6 from 10.1.6.6 (10.0.0.6)
      Origin IGP, metric 0, localpref 100, valid, external
      Received Path ID 0, Local Path ID 0, version 0
      Community: 65004:1000
      Origin-AS validity: (disabled)

Path #1 (post-policy) now carries only 65001:100: 65004:1000 is gone. localpref 200 is still applied, because the match ran against the value before set community. And since the set community sits outside the if block, every route from R6 (including 192.168.5.0/24) gets the tag.

No.559 in the iBGP capture carries the replaced value to R3.

No.559 UPDATE in the iBGP capture (R1 to R3) tshark -V
Border Gateway Protocol - UPDATE Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 74
    Type: UPDATE Message (2)
    Withdrawn Routes Length: 0
    Total Path Attribute Length: 51
    Path attributes
        Path Attribute - MP_REACH_NLRI
            Flags: 0x90, Optional, Extended-Length, Non-transitive, Complete
<snip>
            Type Code: MP_REACH_NLRI (14)
            Length: 13
            Address family identifier (AFI): IPv4 (1)
            Subsequent address family identifier (SAFI): Unicast (1)
            Next hop: 10.0.0.1
                IPv4 Address: 10.0.0.1
            Number of Subnetwork points of attachment (SNPA): 0
            Network Layer Reachability Information (NLRI)
                192.168.6.0/24
                    MP Reach NLRI prefix length: 24
                    MP Reach NLRI IPv4 prefix: 192.168.6.0
        Path Attribute - ORIGIN: IGP
            Flags: 0x40, Transitive, Well-known, Complete
<snip>
            Type Code: ORIGIN (1)
            Length: 1
            Origin: IGP (0)
        Path Attribute - AS_PATH: 65004
            Flags: 0x40, Transitive, Well-known, Complete
<snip>
            Type Code: AS_PATH (2)
            Length: 6
            AS Path segment: 65004
                Segment type: AS_SEQUENCE (2)
                Segment length (number of ASN): 1
                AS4: 65004
        Path Attribute - MULTI_EXIT_DISC: 0
            Flags: 0x80, Optional, Non-transitive, Complete
<snip>
            Type Code: MULTI_EXIT_DISC (4)
            Length: 4
            Multiple exit discriminator: 0
        Path Attribute - LOCAL_PREF: 200
            Flags: 0x40, Transitive, Well-known, Complete
<snip>
            Type Code: LOCAL_PREF (5)
            Length: 4
            Local preference: 200
        Path Attribute - COMMUNITIES: 65001:100
            Flags: 0xc0, Optional, Transitive, Complete
<snip>
            Type Code: COMMUNITIES (8)
            Length: 4
            Communities: 65001:100
                Community: 65001:100
                    Community AS: 65001
                    Community value: 100

Download the pcap of the packet in the tshark output above (No.559 UPDATE)

STEP 4: With `additive`, Both Survive

additive is appended to the same line.

R1 show rpl route-policy FROM-R6 (STEP 4)
RP/0/RP0/CPU0:R1#show rpl route-policy FROM-R6

Wed Sep  9 06:32:15.350 UTC
route-policy FROM-R6
  if community matches-any CS-FROM-R6 then
    set local-preference 200
  endif
  set community (65001:100) additive
  pass
end-policy
!

R1 show bgp 192.168.6.0/24 (STEP 4)
RP/0/RP0/CPU0:R1#show bgp 192.168.6.0/24

Wed Sep  9 06:32:09.384 UTC
BGP routing table entry for 192.168.6.0/24
Versions:
  Process           bRIB/RIB   SendTblVer
  Speaker                 13           13
Last Modified: Sep  9 06:31:52.774 for 00:00:16
Paths: (2 available, best #1)
  Advertised IPv4 Unicast paths to update-groups (with more than one peer):
    0.2 
  Advertised IPv4 Unicast paths to peers (in unique update groups):
    10.1.4.4        
  Path #1: Received by speaker 0
  Advertised IPv4 Unicast paths to update-groups (with more than one peer):
    0.2 
  Advertised IPv4 Unicast paths to peers (in unique update groups):
    10.1.4.4        
  65004
    10.1.6.6 from 10.1.6.6 (10.0.0.6)
      Origin IGP, metric 0, localpref 200, valid, external, best, group-best
      Received Path ID 0, Local Path ID 1, version 13
      Community: 65001:100 65004:1000
      Origin-AS validity: (disabled)
  Path #2: Received by speaker 0
  Not advertised to any peer
  65004, (received-only)
    10.1.6.6 from 10.1.6.6 (10.0.0.6)
      Origin IGP, metric 0, localpref 100, valid, external
      Received Path ID 0, Local Path ID 0, version 0
      Community: 65004:1000
      Origin-AS validity: (disabled)

Community: 65001:100 65004:1000: both are present. Preserving the customer’s tag while adding your own requires additive.

No.605 UPDATE in the iBGP capture (R1 to R2) tshark -V
Border Gateway Protocol - UPDATE Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 78
    Type: UPDATE Message (2)
    Withdrawn Routes Length: 0
    Total Path Attribute Length: 55
    Path attributes
        Path Attribute - MP_REACH_NLRI
            Flags: 0x90, Optional, Extended-Length, Non-transitive, Complete
<snip>
            Type Code: MP_REACH_NLRI (14)
            Length: 13
            Address family identifier (AFI): IPv4 (1)
            Subsequent address family identifier (SAFI): Unicast (1)
            Next hop: 10.0.0.1
                IPv4 Address: 10.0.0.1
            Number of Subnetwork points of attachment (SNPA): 0
            Network Layer Reachability Information (NLRI)
                192.168.6.0/24
                    MP Reach NLRI prefix length: 24
                    MP Reach NLRI IPv4 prefix: 192.168.6.0
        Path Attribute - ORIGIN: IGP
            Flags: 0x40, Transitive, Well-known, Complete
<snip>
            Type Code: ORIGIN (1)
            Length: 1
            Origin: IGP (0)
        Path Attribute - AS_PATH: 65004
            Flags: 0x40, Transitive, Well-known, Complete
<snip>
            Type Code: AS_PATH (2)
            Length: 6
            AS Path segment: 65004
                Segment type: AS_SEQUENCE (2)
                Segment length (number of ASN): 1
                AS4: 65004
        Path Attribute - MULTI_EXIT_DISC: 0
            Flags: 0x80, Optional, Non-transitive, Complete
<snip>
            Type Code: MULTI_EXIT_DISC (4)
            Length: 4
            Multiple exit discriminator: 0
        Path Attribute - LOCAL_PREF: 200
            Flags: 0x40, Transitive, Well-known, Complete
<snip>
            Type Code: LOCAL_PREF (5)
            Length: 4
            Local preference: 200
        Path Attribute - COMMUNITIES: 65001:100 65004:1000
            Flags: 0xc0, Optional, Transitive, Complete
<snip>
            Type Code: COMMUNITIES (8)
            Length: 8
            Communities: 65001:100 65004:1000
                Community: 65001:100
                    Community AS: 65001
                    Community value: 100
                Community: 65004:1000
                    Community AS: 65004
                    Community value: 1000

Download the pcap of the packet in the tshark output above (No.605 UPDATE)

Length: 8 shows two 4-octet communities.

STEP 5: Removing R1’s Inbound Policy

R1’s inbound policy towards R6 goes back to PASS-ALL.

R1 show bgp 192.168.6.0/24 (STEP 5)
RP/0/RP0/CPU0:R1#show bgp 192.168.6.0/24

Wed Sep  9 06:34:55.670 UTC
BGP routing table entry for 192.168.6.0/24
Versions:
  Process           bRIB/RIB   SendTblVer
  Speaker                 15           15
Last Modified: Sep  9 06:34:43.774 for 00:00:12
Paths: (1 available, best #1)
  Advertised IPv4 Unicast paths to update-groups (with more than one peer):
    0.2 
  Advertised IPv4 Unicast paths to peers (in unique update groups):
    10.1.4.4        
  Path #1: Received by speaker 0
  Advertised IPv4 Unicast paths to update-groups (with more than one peer):
    0.2 
  Advertised IPv4 Unicast paths to peers (in unique update groups):
    10.1.4.4        
  65004, (received & used)
    10.1.6.6 from 10.1.6.6 (10.0.0.6)
      Origin IGP, metric 0, localpref 100, valid, external, best, group-best
      Received Path ID 0, Local Path ID 1, version 15
      Community: 65004:1000
      Origin-AS validity: (disabled)

localpref is back to 100 and the only community is 65004:1000.

STEP 6: `NO_EXPORT` Stops at the AS Boundary

R6’s TO-R1 becomes set community (no-export).

R6 show rpl route-policy TO-R1 (STEP 6)
RP/0/RP0/CPU0:R6#show rpl route-policy TO-R1

Wed Sep  9 06:37:59.186 UTC
route-policy TO-R1
  if destination in (192.168.6.0/24) then
    set community (no-export)
  endif
  pass
end-policy
!

R1 show bgp 192.168.6.0/24 (STEP 6)
RP/0/RP0/CPU0:R1#show bgp 192.168.6.0/24

Wed Sep  9 06:38:46.975 UTC
BGP routing table entry for 192.168.6.0/24
Versions:
  Process           bRIB/RIB   SendTblVer
  Speaker                 16           16
Last Modified: Sep  9 06:37:22.774 for 00:01:24
Paths: (2 available, best #2, not advertised to EBGP peer)
  Advertised IPv4 Unicast paths to update-groups (with more than one peer):
    0.2 
  Path #1: Received by speaker 0
  Not advertised to any peer
  65002 65003 65004, (received & used)
    10.1.4.4 from 10.1.4.4 (10.0.0.4)
      Origin IGP, localpref 100, valid, external, group-best
      Received Path ID 0, Local Path ID 0, version 0
      Origin-AS validity: (disabled)
  Path #2: Received by speaker 0
  Advertised IPv4 Unicast paths to update-groups (with more than one peer):
    0.2 
  65004, (received & used)
    10.1.6.6 from 10.1.6.6 (10.0.0.6)
      Origin IGP, metric 0, localpref 100, valid, external, best, group-best
      Received Path ID 0, Local Path ID 1, version 16
      Community: no-export
      Origin-AS validity: (disabled)

R1’s Paths: line now reads not advertised to EBGP peer, and 192.168.6.0/24 has dropped out of what R1 advertises to R4.

R1 show bgp neighbors 10.1.4.4 advertised-routes (STEP 6)
RP/0/RP0/CPU0:R1#show bgp neighbors 10.1.4.4 advertised-routes

Wed Sep  9 06:38:50.455 UTC
Network            Next Hop        From            AS Path
192.168.1.0/24     10.1.4.1        Local           65001i
192.168.2.0/24     10.1.4.1        10.0.0.2        65001i
192.168.3.0/24     10.1.4.1        10.0.0.3        65001i

Processed 3 prefixes, 3 paths

It is still distributed over iBGP, and R2 ends up in the same state.

R2 show bgp neighbors 10.2.4.4 advertised-routes (STEP 6)
RP/0/RP0/CPU0:R2#show bgp neighbors 10.2.4.4 advertised-routes

Wed Sep  9 06:39:19.485 UTC
Network            Next Hop        From            AS Path
192.168.1.0/24     10.2.4.2        10.0.0.1        65001i
192.168.2.0/24     10.2.4.2        Local           65001i
192.168.3.0/24     10.2.4.2        10.0.0.3        65001i

Processed 3 prefixes, 3 paths

Nothing was configured on R2: R1 handed the route over with NO_EXPORT attached, so the rule applies per AS. R4 is left with the path via R5 (65003 65004).

R4 show bgp 192.168.6.0/24 (STEP 6)
RP/0/RP0/CPU0:R4#show bgp 192.168.6.0/24

Wed Sep  9 06:39:59.467 UTC
BGP routing table entry for 192.168.6.0/24
Versions:
  Process           bRIB/RIB   SendTblVer
  Speaker                 16           16
Last Modified: Sep  9 06:37:22.774 for 00:02:36
Paths: (1 available, best #1)
  Advertised IPv4 Unicast paths to peers (in unique update groups):
    10.2.4.2        10.1.4.1        
  Path #1: Received by speaker 0
  Advertised IPv4 Unicast paths to peers (in unique update groups):
    10.2.4.2        10.1.4.1        
  65003 65004, (received & used)
    10.4.5.5 from 10.4.5.5 (10.0.0.5)
      Origin IGP, localpref 100, valid, external, best, group-best
      Received Path ID 0, Local Path ID 1, version 16
      Origin-AS validity: (disabled)

No.321 in the eBGP capture carried the NO_EXPORT.

No.321 UPDATE (R6 to R1) tshark -V
Border Gateway Protocol - UPDATE Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 67
    Type: UPDATE Message (2)
    Withdrawn Routes Length: 0
    Total Path Attribute Length: 44
    Path attributes
        Path Attribute - MP_REACH_NLRI
            Flags: 0x90, Optional, Extended-Length, Non-transitive, Complete
<snip>
            Type Code: MP_REACH_NLRI (14)
            Length: 13
            Address family identifier (AFI): IPv4 (1)
            Subsequent address family identifier (SAFI): Unicast (1)
            Next hop: 10.1.6.6
                IPv4 Address: 10.1.6.6
            Number of Subnetwork points of attachment (SNPA): 0
            Network Layer Reachability Information (NLRI)
                192.168.6.0/24
                    MP Reach NLRI prefix length: 24
                    MP Reach NLRI IPv4 prefix: 192.168.6.0
        Path Attribute - ORIGIN: IGP
            Flags: 0x40, Transitive, Well-known, Complete
<snip>
            Type Code: ORIGIN (1)
            Length: 1
            Origin: IGP (0)
        Path Attribute - AS_PATH: 65004
            Flags: 0x40, Transitive, Well-known, Complete
<snip>
            Type Code: AS_PATH (2)
            Length: 6
            AS Path segment: 65004
                Segment type: AS_SEQUENCE (2)
                Segment length (number of ASN): 1
                AS4: 65004
        Path Attribute - MULTI_EXIT_DISC: 0
            Flags: 0x80, Optional, Non-transitive, Complete
<snip>
            Type Code: MULTI_EXIT_DISC (4)
            Length: 4
            Multiple exit discriminator: 0
        Path Attribute - COMMUNITIES: NO_EXPORT
            Flags: 0xc0, Optional, Transitive, Complete
<snip>
            Type Code: COMMUNITIES (8)
            Length: 4
            Communities: NO_EXPORT
                Community Well-known: NO_EXPORT (0xffffff01)

NO_EXPORT (0xffffff01) is the value straight out of RFC 1997.

Download the pcap of the packet in the tshark output above (No.321 UPDATE)

STEP 7: `NO_ADVERTISE` Stops at the Router

TO-R1 becomes set community (no-advertise).

R6 show rpl route-policy TO-R1 (STEP 7)
RP/0/RP0/CPU0:R6#show rpl route-policy TO-R1

Wed Sep  9 06:40:52.536 UTC
route-policy TO-R1
  if destination in (192.168.6.0/24) then
    set community (no-advertise)
  endif
  pass
end-policy
!

R1 now reports not advertised to any peer.

R1 show bgp 192.168.6.0/24 (STEP 7)
RP/0/RP0/CPU0:R1#show bgp 192.168.6.0/24

Wed Sep  9 06:41:35.790 UTC
BGP routing table entry for 192.168.6.0/24
Versions:
  Process           bRIB/RIB   SendTblVer
  Speaker                 17           17
Last Modified: Sep  9 06:40:35.774 for 00:01:00
Paths: (3 available, best #3, not advertised to any peer)
  Not advertised to any peer
  Path #1: Received by speaker 0
  Not advertised to any peer
  65002 65003 65004, (received & used)
    10.0.0.2 (metric 3) from 10.0.0.2 (10.0.0.2)
      Origin IGP, localpref 100, valid, internal
      Received Path ID 0, Local Path ID 0, version 0
  Path #2: Received by speaker 0
  Not advertised to any peer
  65002 65003 65004, (received & used)
    10.1.4.4 from 10.1.4.4 (10.0.0.4)
      Origin IGP, localpref 100, valid, external, group-best
      Received Path ID 0, Local Path ID 0, version 0
      Origin-AS validity: (disabled)
  Path #3: Received by speaker 0
  Not advertised to any peer
  65004, (received & used)
    10.1.6.6 from 10.1.6.6 (10.0.0.6)
      Origin IGP, metric 0, localpref 100, valid, external, best, group-best
      Received Path ID 0, Local Path ID 1, version 17
      Community: no-advertise
      Origin-AS validity: (disabled)

It has also disappeared from what R1 advertises to its iBGP peers.

R1 show bgp neighbors 10.0.0.2 advertised-routes (STEP 7)
RP/0/RP0/CPU0:R1#show bgp neighbors 10.0.0.2 advertised-routes

Wed Sep  9 06:41:38.012 UTC
Network            Next Hop        From            AS Path
192.168.1.0/24     10.0.0.1        Local           i
192.168.4.0/24     10.0.0.1        10.1.4.4        65002i
192.168.5.0/24     10.0.0.1        10.1.4.4        65002 65003i

Processed 3 prefixes, 3 paths

R1 withdraws the route it had already advertised (No.681 in the iBGP capture).

No.681 UPDATE in the iBGP capture (R1 to R3, withdraw) tshark -V
Border Gateway Protocol - UPDATE Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 27
    Type: UPDATE Message (2)
    Withdrawn Routes Length: 4
    Withdrawn Routes
        192.168.6.0/24
            Withdrawn route prefix length: 24
            Withdrawn prefix: 192.168.6.0
    Total Path Attribute Length: 0

Download the pcap of the packet in the tshark output above (No.681 withdraw)

R3 does not lose 192.168.6.0/24: it falls back to the path through R2 (65002 65003 65004).

R3 show bgp 192.168.6.0/24 (STEP 7)
RP/0/RP0/CPU0:R3#show bgp 192.168.6.0/24

Wed Sep  9 06:42:28.378 UTC
BGP routing table entry for 192.168.6.0/24
Versions:
  Process           bRIB/RIB   SendTblVer
  Speaker                 17           17
Last Modified: Sep  9 06:40:36.774 for 00:01:51
Paths: (1 available, best #1)
  Not advertised to any peer
  Path #1: Received by speaker 0
  Not advertised to any peer
  65002 65003 65004, (received & used)
    10.0.0.2 (metric 2) from 10.0.0.2 (10.0.0.2)
      Origin IGP, localpref 100, valid, internal, best, group-best
      Received Path ID 0, Local Path ID 1, version 17

NO_ADVERTISE does not delete the destination; it only stops one path from being distributed.

No.335 in the eBGP capture carried the NO_ADVERTISE.

No.335 UPDATE (R6 to R1) tshark -V
Border Gateway Protocol - UPDATE Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 67
    Type: UPDATE Message (2)
    Withdrawn Routes Length: 0
    Total Path Attribute Length: 44
    Path attributes
        Path Attribute - MP_REACH_NLRI
            Flags: 0x90, Optional, Extended-Length, Non-transitive, Complete
<snip>
            Type Code: MP_REACH_NLRI (14)
            Length: 13
            Address family identifier (AFI): IPv4 (1)
            Subsequent address family identifier (SAFI): Unicast (1)
            Next hop: 10.1.6.6
                IPv4 Address: 10.1.6.6
            Number of Subnetwork points of attachment (SNPA): 0
            Network Layer Reachability Information (NLRI)
                192.168.6.0/24
                    MP Reach NLRI prefix length: 24
                    MP Reach NLRI IPv4 prefix: 192.168.6.0
        Path Attribute - ORIGIN: IGP
            Flags: 0x40, Transitive, Well-known, Complete
<snip>
            Type Code: ORIGIN (1)
            Length: 1
            Origin: IGP (0)
        Path Attribute - AS_PATH: 65004
            Flags: 0x40, Transitive, Well-known, Complete
<snip>
            Type Code: AS_PATH (2)
            Length: 6
            AS Path segment: 65004
                Segment type: AS_SEQUENCE (2)
                Segment length (number of ASN): 1
                AS4: 65004
        Path Attribute - MULTI_EXIT_DISC: 0
            Flags: 0x80, Optional, Non-transitive, Complete
<snip>
            Type Code: MULTI_EXIT_DISC (4)
            Length: 4
            Multiple exit discriminator: 0
        Path Attribute - COMMUNITIES: NO_ADVERTISE
            Flags: 0xc0, Optional, Transitive, Complete
<snip>
            Type Code: COMMUNITIES (8)
            Length: 4
            Communities: NO_ADVERTISE
                Community Well-known: NO_ADVERTISE (0xffffff02)

Download the pcap of the packet in the tshark output above (No.335 UPDATE)

STEP 8: A User-Defined Community Narrows the Advertisement (Final State)

The last STEP reproduces NTT’s 2914:429: AS 65001 publishes 65001:429 meaning “do not advertise to R4,” and R6 attaches it. On R6 the only change is set community (65001:429); the upper half is AS 65001, the party that defines the meaning.

R6 show rpl route-policy TO-R1 (STEP 8)
RP/0/RP0/CPU0:R6#show rpl route-policy TO-R1

Wed Sep  9 06:44:06.630 UTC
route-policy TO-R1
  if destination in (192.168.6.0/24) then
    set community (65001:429)
  endif
  pass
end-policy
!

R1 gets the match and the drop.

R1 show rpl community-set CS-NO-ADV-R4 (STEP 8)
RP/0/RP0/CPU0:R1#show rpl community-set CS-NO-ADV-R4

Wed Sep  9 06:44:56.006 UTC
community-set CS-NO-ADV-R4
  65001:429
end-set
!

R1 show rpl route-policy TO-R4 (STEP 8)
RP/0/RP0/CPU0:R1#show rpl route-policy TO-R4

Wed Sep  9 06:44:54.180 UTC
route-policy TO-R4
  if community matches-any CS-NO-ADV-R4 then
    drop
  endif
  pass
end-policy
!

Not being a well-known community, it produces no special annotation in R1’s BGP table.

R1 show bgp 192.168.6.0/24 (STEP 8)
RP/0/RP0/CPU0:R1#show bgp 192.168.6.0/24

Wed Sep  9 06:44:49.322 UTC
BGP routing table entry for 192.168.6.0/24
Versions:
  Process           bRIB/RIB   SendTblVer
  Speaker                 18           18
Last Modified: Sep  9 06:43:35.774 for 00:01:13
Paths: (2 available, best #2)
  Advertised IPv4 Unicast paths to update-groups (with more than one peer):
    0.2 
  Path #1: Received by speaker 0
  Not advertised to any peer
  65002 65003 65004, (received & used)
    10.1.4.4 from 10.1.4.4 (10.0.0.4)
      Origin IGP, localpref 100, valid, external, group-best
      Received Path ID 0, Local Path ID 0, version 0
      Origin-AS validity: (disabled)
  Path #2: Received by speaker 0
  Advertised IPv4 Unicast paths to update-groups (with more than one peer):
    0.2 
  65004, (received & used)
    10.1.6.6 from 10.1.6.6 (10.0.0.6)
      Origin IGP, metric 0, localpref 100, valid, external, best, group-best
      Received Path ID 0, Local Path ID 1, version 18
      Community: 65001:429
      Origin-AS validity: (disabled)

It has dropped out of what R1 advertises to R4.

R1 show bgp neighbors 10.1.4.4 advertised-routes (STEP 8)
RP/0/RP0/CPU0:R1#show bgp neighbors 10.1.4.4 advertised-routes

Wed Sep  9 06:44:51.989 UTC
Network            Next Hop        From            AS Path
192.168.1.0/24     10.1.4.1        Local           65001i
192.168.2.0/24     10.1.4.1        10.0.0.2        65001i
192.168.3.0/24     10.1.4.1        10.0.0.3        65001i

Processed 3 prefixes, 3 paths

Over iBGP it flows as usual, since this is only R1 dropping the route in one outbound policy.

A User-Defined Community Leaks Unless Every Border Router Enforces It

R2, the other border router, has no drop configured.

R2 show bgp neighbors 10.2.4.4 advertised-routes (STEP 8)
RP/0/RP0/CPU0:R2#show bgp neighbors 10.2.4.4 advertised-routes

Wed Sep  9 06:45:21.155 UTC
Network            Next Hop        From            AS Path
192.168.1.0/24     10.2.4.2        10.0.0.1        65001i
192.168.2.0/24     10.2.4.2        Local           65001i
192.168.3.0/24     10.2.4.2        10.0.0.3        65001i
192.168.6.0/24     10.2.4.2        10.0.0.1        65001 65004i

Processed 4 prefixes, 4 paths

192.168.6.0/24 is advertised to R4 and arrives with the community attached.

NO_EXPORT is specified by the protocol; a user-defined community only does what each router’s policy makes it do, so every border router needs the same match.

No.347 in the eBGP capture carried 65001:429.

No.347 UPDATE (R6 to R1) tshark -V
Border Gateway Protocol - UPDATE Message
    Marker: ffffffffffffffffffffffffffffffff
    Length: 67
    Type: UPDATE Message (2)
    Withdrawn Routes Length: 0
    Total Path Attribute Length: 44
    Path attributes
        Path Attribute - MP_REACH_NLRI
            Flags: 0x90, Optional, Extended-Length, Non-transitive, Complete
<snip>
            Type Code: MP_REACH_NLRI (14)
            Length: 13
            Address family identifier (AFI): IPv4 (1)
            Subsequent address family identifier (SAFI): Unicast (1)
            Next hop: 10.1.6.6
                IPv4 Address: 10.1.6.6
            Number of Subnetwork points of attachment (SNPA): 0
            Network Layer Reachability Information (NLRI)
                192.168.6.0/24
                    MP Reach NLRI prefix length: 24
                    MP Reach NLRI IPv4 prefix: 192.168.6.0
        Path Attribute - ORIGIN: IGP
            Flags: 0x40, Transitive, Well-known, Complete
<snip>
            Type Code: ORIGIN (1)
            Length: 1
            Origin: IGP (0)
        Path Attribute - AS_PATH: 65004
            Flags: 0x40, Transitive, Well-known, Complete
<snip>
            Type Code: AS_PATH (2)
            Length: 6
            AS Path segment: 65004
                Segment type: AS_SEQUENCE (2)
                Segment length (number of ASN): 1
                AS4: 65004
        Path Attribute - MULTI_EXIT_DISC: 0
            Flags: 0x80, Optional, Non-transitive, Complete
<snip>
            Type Code: MULTI_EXIT_DISC (4)
            Length: 4
            Multiple exit discriminator: 0
        Path Attribute - COMMUNITIES: 65001:429
            Flags: 0xc0, Optional, Transitive, Complete
<snip>
            Type Code: COMMUNITIES (8)
            Length: 4
            Communities: 65001:429
                Community: 65001:429
                    Community AS: 65001
                    Community value: 429

Download the pcap of the packet in the tshark output above (No.347 UPDATE)

Summary of the Verification

STEP	Community set by R6	R1 behaviour	R2 and R3 (iBGP)	R4 (AS 65002)
1	`65004:1000`	Passes it through	Receives it	Receives it
3	(R1 overwrites with `65001:100`)	Discards the original	`65001:100` only	`65001:100` only
4	(R1 adds with `additive`)	Keeps both	Both arrive	Both arrive
6	`NO_EXPORT`	Not advertised to eBGP	Receives it; R2 also stops advertising to eBGP	Does not arrive
7	`NO_ADVERTISE`	Not advertised anywhere	Does not arrive (withdrawn)	Does not arrive
8	`65001:429`	Dropped in `TO-R4`	Receives it	Not from R1, but leaks from R2

Verification Configs and show Output

Each STEP captures three kinds of file from all six routers. The verification config is the ..._run.txt (final state: STEP 8).

File	Contents
`..._show.txt`	`show version`, `show interface description`, `show route`, `show bgp`, `show bgp community <value>`, `show bgp neighbors <peer> advertised-routes / routes / received routes`, `show rpl route-policy` and more
`..._log.txt`	`show logging` limited to that STEP. A `logmsg` marker is written at the start of each STEP and its timestamp passed to `show logging start`
`..._run.txt`	`show running-config` at that point in time (that is, the verification config for the STEP)

STEP 0: Initial state

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run
R4	show	log	run
R5	show	log	run
R6	show	log	run

STEP 1: R6 tags 192.168.6.0/24 with 65004:1000

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run
R4	show	log	run
R5	show	log	run
R6	show	log	run

STEP 2: R1 matches the community and raises LOCAL_PREF

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run
R4	show	log	run
R5	show	log	run
R6	show	log	run

STEP 3: set community without additive

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run
R4	show	log	run
R5	show	log	run
R6	show	log	run

STEP 4: Adding additive

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run
R4	show	log	run
R5	show	log	run
R6	show	log	run

STEP 5: Removing R1 inbound policy

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run
R4	show	log	run
R5	show	log	run
R6	show	log	run

STEP 6: R6 sets NO_EXPORT

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run
R4	show	log	run
R5	show	log	run
R6	show	log	run

STEP 7: R6 sets NO_ADVERTISE

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run
R4	show	log	run
R5	show	log	run
R6	show	log	run

STEP 8: User-defined community 65001:429 narrows the advertisement (final state)

Router	show output	syslog	running-config
R1	show	log	run
R2	show	log	run
R3	show	log	run
R4	show	log	run
R5	show	log	run
R6	show	log	run

Download the full R1-R6 (eBGP) capture

Download the full R1-R3 (iBGP) capture

References

Source	Title	Summary
RFC 1997	BGP Communities Attribute	Defines the COMMUNITY attribute: type code 8, optional transitive, four octets, the reserved ranges, and `NO_EXPORT` / `NO_ADVERTISE` / `NO_EXPORT_SUBCONFED`.
RFC 4360	BGP Extended Communities Attribute	Defines Extended Communities (type code 16, eight octets).
RFC 8092	BGP Large Communities Attribute	Defines Large Communities (type code 32, twelve octets, three 32-bit fields), which accommodate 4-byte AS numbers.
RFC 7999	BLACKHOLE Community	Defines `65535:666` (`0xFFFF029A`). Informational.
RFC 8326	Graceful BGP Session Shutdown	Defines `GRACEFUL_SHUTDOWN` (`65535:0` / `0xFFFF0000`).
NTT	Routing - NTT-GIN	The community list AS2914 publishes for its customers, including `2914:429` and `65500:nnn`. A good look at how communities are used in production.