BGP Administrative Shutdown Communication
obsoleted by
- rfc-9003 — Extended BGP Administrative Shutdown Communication
updates
- rfc-4486 — Subcodes for BGP Cease Notification Message
Extracted elements (17)
The 128-octet maximum length for Shutdown Communication serves dual purposes: it is sufficient to carry a meaningful human-readable message (including a ticket reference and brief explanation), and it limits the surface area for log injection attacks against syslog systems that may display the message.
UTF-8 encoding was chosen for the Shutdown Communication field to support international characters, enabling operators worldwide to communicate shutdown reasons in their native languages.
This document updates RFC 4486 by adding an optional Shutdown Communication field to Cease NOTIFICATION messages with subcodes 2 and 4. BGP speakers that do not support this extension will still receive valid Cease NOTIFICATIONs since the communication is optional (Length may be zero).
A receiving BGP speaker MUST NOT interpret invalid UTF-8 sequences in the Shutdown Communication field.
If a Shutdown Communication with an invalid Length value or invalid UTF-8 sequence is received, a message indicating this event SHOULD be logged for operator attention. An erroneous or malformed Shutdown Communication itself MAY be logged in hexdump format.
Mechanisms for reporting Shutdown Communication content are implementation specific but SHOULD include methods such as Syslog.
The Length field MUST range from 0 to 128 inclusive. This 8-bit field represents the length of the Shutdown Communication in octets.
The Shutdown Communication field MUST be encoded using UTF-8 to support international characters. The field is not NUL terminated.
The Subcode field in the Cease NOTIFICATION with Shutdown Communication MUST be either 2 ('Administrative Shutdown') or 4 ('Administrative Reset').
UTF-8 'Shortest Form' encoding is REQUIRED to guard against Unicode security issues outlined in Unicode Technical Report #36.
Users of this mechanism should apply data minimization practices per RFC 6973 Section 6.1, because a received Shutdown Communication may be used at the receiver's discretion and could expose operational details.
The Shutdown Communication is an optional UTF-8 encoded freeform string, up to 128 octets, carried in the Data portion of a BGP Cease NOTIFICATION message with subcode 'Administrative Shutdown' (2) or 'Administrative Reset' (4). Its contents are at the operator's discretion.
IANA references RFC 8203 (in addition to RFC 4486) for subcodes 'Administrative Shutdown' (2) and 'Administrative Reset' (4) in the 'Cease NOTIFICATION message subcodes' registry under 'Border Gateway Protocol (BGP) Parameters'.
The Shutdown Communication is limited to 128 octets to reduce the risk of log injection attacks, where a crafted message could be formatted by receiving systems to appear as additional syslog messages.
UTF-8 encoding introduces Unicode security issues (detailed in UTR#36); implementers and operators are advised to review that report. Shortest Form UTF-8 encoding is required to mitigate these issues.
Without a transport providing integrity, a Shutdown Communication message could be forged; without confidentiality, it could be snooped. These risks are common to BGP messages generally but are of greater concern here since the communication is intended for human-to-human use.
The Cease NOTIFICATION message with Shutdown Communication encodes Error Code 6, an 8-bit Subcode (2 or 4), an 8-bit Length field (0–128 octets), and a variable-length UTF-8 Shutdown Communication field. The Length field indicates the byte count of the Shutdown Communication; when zero, no communication field follows.