For nearly two decades, BGP-4 had a dirty secret written right into its specification: if a router received a malformed UPDATE message on a session, the only sanctioned response was to tear the entire session down. RFC 4271 called this "notification and close." One bad attribute on one prefix, and every route that peer had ever advertised — potentially hundreds of thousands of them — vanished, triggering a global reconvergence storm. RFC 7606 is the pragmatic, painfully-overdue fix.

The problem in practice. BGP sessions carry a firehose of UPDATE messages, each containing path attributes (AS_PATH, NEXT_HOP, MED, communities, and dozens of others). Attributes are TLV-encoded. A buggy vendor implementation, a corrupted optional transitive attribute passed hop-by-hop across ASes, or a novel attribute type nobody's parser handled correctly — any of these could produce a syntactically invalid UPDATE. The 4271 rule said: kill the session. This produced real outages. The most famous class involves optional transitive attributes: AS X originates something odd, it traverses AS Y (who doesn't understand it but passes it through per the "transitive" rule), and lands at AS Z whose parser chokes. AS Z resets its session with AS Y. Y's session flaps take down thousands of prefixes.

The graduated response. RFC 7606 introduces a hierarchy of error-handling actions, from least to most disruptive:

• Attribute discard — silently drop the malformed attribute, keep the rest of the UPDATE.
• Treat-as-withdraw — the UPDATE's NLRI (announced prefixes) is treated as if it were a withdrawal. Nothing new is installed; anything previously advertised from that peer for those prefixes is withdrawn. Crucially, the session survives.
• Session reset — the old behavior, now reserved for genuinely unrecoverable framing errors (bad message length, malformed NLRI encoding that prevents parsing subsequent updates).
• AFI/SAFI disable — turn off one address family (say, IPv6 unicast) without dropping the session.

Per-attribute rules. The RFC then does the tedious, essential work of walking through every path attribute defined at the time and specifying exactly which action applies to which error. ORIGIN with an undefined value? Treat-as-withdraw. AS_PATH malformed? Session reset (you literally cannot loop-detect without it). MULTI_EXIT_DISC with wrong length? Treat-as-withdraw. Unknown optional transitive with the partial bit set incorrectly? Discard the attribute. This table is the operational heart of the document.

Why it matters today. Every major BGP implementation — Cisco IOS-XR, Juniper Junos, Arista EOS, Nokia SR OS, BIRD, FRR — has implemented 7606. It is arguably the single most important reliability improvement to the internet's routing plane since graceful restart. When you read a post-mortem where "a malformed BGP attribute from a peer" causes a partial outage instead of a full session teardown cascading across the DFZ, that's 7606 doing its job silently. Before 7606, incidents like the 2010 "Cisco/RIPE experiment" that accidentally propagated a novel attribute type caused widespread session resets across the internet; 7606-compliant routers would have quietly discarded the attribute and moved on.

A design lesson. The original "fail closed at session scope" was arguably correct 1990s thinking: if you can't trust one message, you can't trust the peer. But at internet scale, session resets are the outage. RFC 7606 accepts a subtler truth — the blast radius of your error handler matters as much as its strictness. Fail as small as you can while still failing safely.