BGPKeepAlive generates 38-byte packets instead of RFC 4271-required 19 bytes

[shadimotaali]

Brief description

The BGPKeepAlive class uses multiple inheritance from both BGP and BGPHeader, combined with the existing bind_layers(BGPHeader, BGPKeepAlive, {"type": 4}) binding. This causes a duplicate header to be appended at packet build time, resulting in 38-byte KEEPALIVE packets instead of the 19 octets required by RFC 4271:

"A KEEPALIVE message consists of only the message header and has a length of 19 octets."

Scapy version

2.4.5

Python version

3.8

Operating system

Linux 5.10.46

Additional environment information

No response

How to reproduce

To reproduce: build a BGPKeepAlive() packet and inspect its length via len(BGPKeepAlive()).
Workaround: instantiating BGPKeepAlive() directly without layering it on BGPHeader produces a compliant 19-byte packet. This has been validated against GNS3 simulations with Cisco IOS routers and real Cisco BGP traces.

Actual result

No response

Expected result

No response

Related resources

No response

[guedou]

Thanks for the report. Can you share a full example to reproduce this?

[shadimotaali]

Thanks for the report. Can you share a full example to reproduce this?

from scapy.contrib.bgp import BGPKeepAlive

pkt = BGPKeepAlive()
print(len(pkt)) # Output: 38 — violates RFC 4271 (should be 19)

The double inheritance class BGPKeepAlive(BGP, BGPHeader) combined with bind_layers(BGPHeader, BGPKeepAlive, {"type": 4}) causes a duplicate header at build time.

from scapy.contrib.bgp import BGPHeader

keepalive = BGPHeader(type=4)
print(len(keepalive)) # Output: 19 — RFC 4271 compliant

Validated via Wireshark capture, confirming the packet length field, and cross-checked against GNS3 with Cisco IOS routers.

[guedou]

Thanks.
How do you build the packet that you are analyzing with Wireshark?

[shadimotaali]

Thanks. How do you build the packet that you are analyzing with Wireshark?

The packets analyzed in Wireshark are built programmatically using Python Scapy library (scapy.contrib.bgp), which allows constructing RFC-compliant BGP messages layer by layer. Specifically:

Layer stack: Each packet is constructed as Ether() / IP() / TCP() / BGPHeader() / BGPUpdate(...), reflecting a real TCP/IP session over port 179.
BGP message construction: UPDATE messages are built by populating Scapy BGP contrib objects with real path attributes — BGPPAOrigin, BGPPAASPath, BGPPANextHop, BGPPAMultiExitDisc, BGPPALocalPref, BGPPACommunity — along with NLRI prefixes (e.g., BGPNLRIIPv4).
Session simulation: The full BGP FSM (OPEN → KEEPALIVE → UPDATE → NOTIFICATION) is simulated to produce a realistic packet stream, including proper TCP sequence numbers and ACKs.
Written to PCAP: All packets are saved to a .pcap file using Scapy's wrpcap() function, which is then opened directly in Wireshark for inspection.
Validation loop: To confirm correctness, the PCAP is also reverse-engineered back into Scapy code using a PCAP-to-Scapy conversion tool, and Wireshark dissection confirms full RFC 4271 compliance.

[guedou]

Please share the full code that write the BGP keep alive into the pcap. That will help investigate your issue.

[guedou]

It seems that you are using Scapy incorrectly. The following code works fine:

>> load_contrib('bgp')
>>> pkt = IP() / TCP(dport=179) / BGPKeepAlive()
>>> assert len(raw(pkt[BGPKeepAlive])) == 19

The same applies to other BGP messages.