@takodotid/circuit 0.37.0 → 0.38.0

package/src/helpers/cables.ts

@@ -0,0 +1,91 @@
+import { Catalog, type ModelName, type PlatformName, type PortName } from "../platforms/catalog";
+
+/** One end of a cable: the device, and its platform and model, which name its ports. */
+export type CableEnd<P extends PlatformName, M extends ModelName<P>> = {
+    device: string;
+    platform: P;
+    model: M;
+};
+
+/** The far end of a port, for its description: the device, the port by Circuit's name, and by the name printed on the device. */
+export type FarEnd = { device: string; port: string; label: string };
+
+/** What every cable of one entry shares. */
+type Shared = {
+    /** What is between the two ends, such as a carrier's local loop. Both ends get it on their `link`. */
+    through?: string;
+    /** A port's description from its far end. The far device and the far port's label when absent, such as `firewall-1 port6`. */
+    describe?: (far: FarEnd) => string;
+};
+
+/** A port a cable builds: what it is, the LAG it is in, and the other end. */
+type CablePort<L extends string> = {
+    description: string;
+    link: { device: string; port: string; through?: string };
+    lag?: L;
+};
+
+/** Ports for both ends of the cables between two of our devices, each cable written once. */
+export class Cables {
+    /**
+     * One cable, both ends. Spread each end into its device's `ports`:
+     *
+     * ```ts
+     * const uplink = Cables.link({ a: { device: "router-1", platform: "routeros", model: "CCR2216-1G-12XS-2XQ", port: "25g-1" }, b: { ... } });
+     * // router-1: ports: { ...uplink.a }
+     * ```
+     */
+    static link<
+        const PA extends PlatformName,
+        const MA extends ModelName<PA>,
+        const NA extends PortName<PA, MA>,
+        const PB extends PlatformName,
+        const MB extends ModelName<PB>,
+        const NB extends PortName<PB, MB>,
+    >(spec: Shared & { a: CableEnd<PA, MA> & { port: NA }; b: CableEnd<PB, MB> & { port: NB } }) {
+        return {
+            a: { [spec.a.port]: Cables.end(spec, spec.b, spec.b.port) } as Record<NA, CablePort<never>>,
+            b: { [spec.b.port]: Cables.end(spec, spec.a, spec.a.port) } as Record<NB, CablePort<never>>,
+        };
+    }
+
+    /**
+     * The cables of a LAG, both ends, from one list read from end A: `{ "25g-1": "10g-2" }` is a cable from A's 25g-1 to B's 10g-2. Each port is a member of its end's LAG. Spread each end into its device's `ports`; the LAG itself stays on each device.
+     */
+    static lag<
+        const PA extends PlatformName,
+        const MA extends ModelName<PA>,
+        const LA extends string,
+        const PB extends PlatformName,
+        const MB extends ModelName<PB>,
+        const LB extends string,
+        const C extends Partial<Record<PortName<PA, MA>, PortName<PB, MB>>>,
+    >(spec: Shared & { a: CableEnd<PA, MA> & { lag: LA }; b: CableEnd<PB, MB> & { lag: LB }; cables: C }) {
+        const pairs = Object.entries(spec.cables) as [string, string][];
+
+        const taken = new Map<string, string>();
+        for (const [near, far] of pairs) {
+            const other = taken.get(far);
+            if (other) throw new Error(`Cables.lag: ${spec.b.device} ${far} is cabled to both ${other} and ${near} on ${spec.a.device}`);
+            taken.set(far, near);
+        }
+
+        const a = Object.fromEntries(pairs.map(([near, far]) => [near, { ...Cables.end(spec, spec.b, far), lag: spec.a.lag }]));
+        const b = Object.fromEntries(pairs.map(([near, far]) => [far, { ...Cables.end(spec, spec.a, near), lag: spec.b.lag }]));
+
+        return {
+            a: a as Record<keyof C & string, CablePort<LA>>,
+            b: b as Record<NonNullable<C[keyof C]> & string, CablePort<LB>>,
+        };
+    }
+
+    /** A port facing `port` on the far device. */
+    private static end(shared: Shared, far: { device: string; platform: string; model: string }, port: string): CablePort<never> {
+        const farEnd = { device: far.device, port, label: Catalog.spell(far.platform, far.model, port) };
+
+        return {
+            description: shared.describe ? shared.describe(farEnd) : `${farEnd.device} ${farEnd.label}`,
+            link: { device: far.device, port, ...(shared.through ? { through: shared.through } : {}) },
+        };
+    }
+}

package/src/helpers/index.ts

@@ -1,12 +1,16 @@
-// Building blocks most networks write the same way: address lists, edge filters, a BGP import sanity policy, an exchange's member ports and route servers, checks, and helpers for checks of your own. Each returns plain config to place where it belongs, so nothing here applies itself.
+// Building blocks most networks write the same way: address lists, cables written once for both ends, edge filters, a BGP import sanity policy, an exchange's member ports and route servers, upstreams written once, checks, and helpers for checks of your own. Each returns plain config to place where it belongs, so nothing here applies itself.
 
 export { Bgp } from "./bgp";
-export type { CommunityScheme, SanityLengths } from "./bgp";
+export type { Announced, CommunityScheme, DefaultOnlyOptions, LearnOptions, SanityLengths } from "./bgp";
+export { Cables } from "./cables";
+export type { CableEnd, FarEnd } from "./cables";
 export { Checks } from "./checks";
 export type { TrustBoundary } from "./checks";
 export { Exchange } from "./exchange";
 export type { ExchangeMember, InternetExchange } from "./exchange";
 export { Filters } from "./filters";
 export { RouteServerConfig } from "./route-server";
+export { Upstreams } from "./upstreams";
+export type { Upstream, UpstreamCatalog, UpstreamPolicies } from "./upstreams";
 export type { RouteServer } from "./route-server";
 export type { AntiAmplificationOptions } from "./filters";

package/src/helpers/upstreams.ts

@@ -0,0 +1,306 @@
+import { Address } from "../core/address";
+import type {
+    Exchange as ExchangeLan,
+    Family,
+    FilterRule,
+    Gre,
+    InterfaceAddress,
+    IP,
+    LargeCommunity,
+    Neighbor,
+    NeighborSettings,
+    PolicyRule,
+    Port,
+    Prefix,
+    Secret,
+    StandardCommunity,
+    Vlan,
+    VlanInterface,
+} from "../schema";
+import { Bgp, type Announced } from "./bgp";
+
+/** One network we exchange routes with: a transit we buy, an exchange's route servers, or a peer. */
+export type Upstream = {
+    /** Its name as people write it, for descriptions: `Transit A`. The key when absent. */
+    name?: string;
+    asn: number;
+    /** What it is to us: `provider` for a transit, `rs` for an exchange's route servers, `peer` for a direct session. */
+    role: "provider" | "rs" | "peer";
+    /** Where it lands on our side: a VLAN, our addresses on it, and the switch port it arrives on. A peer over a tunnel, or over an exchange's VLAN, has none. */
+    handoff?: {
+        /** The VLAN's ID. */
+        vlan: number;
+        /** It sends its VLAN tagged: its port gets a native VLAN of its own with this ID, which nothing else is in. Untagged when absent. */
+        native?: number;
+        /** Our addresses on it. `{ address, peer }` for a point-to-point address whose far end is outside its own prefix. */
+        addresses: readonly (InterfaceAddress | { address: InterfaceAddress; peer: IP })[];
+        /** The switch port it arrives on. */
+        port?: { device: string; port: string; storm_control?: Port<string, string, string, string>["storm_control"] };
+        /** An exchange's LAN, for `circuit peeringdb`. */
+        exchange?: ExchangeLan;
+    };
+    /** A GRE tunnel to it. */
+    tunnel?: { local: IP; remote: IP; addresses: readonly InterfaceAddress[]; mtu?: number };
+    /** Our BGP sessions with it, by name: its address, and ours when it is not the interface's. */
+    sessions: Readonly<Record<string, { address: IP; local_address?: IP }>>;
+    /** The sessions are more than one hop away, from this address of ours. They share a group. */
+    multihop?: { local_address: IP; families?: readonly Family[]; password?: Secret };
+    /** The most prefixes a session may send, by its family: about twice what it sends. Over it, the session closes until it is cleared. */
+    limits?: { ipv4?: number; ipv6?: number };
+    /** What we take. Nothing when absent. */
+    import?: {
+        /** Its default route, at this preference. */
+        default?: { local_pref?: number; description?: string };
+        /** Its routes, through `Bgp.learn`: the `before` rules, sanity, this preference, the tag. Only the default when absent. */
+        learn?: { local_pref?: number; before?: readonly PolicyRule<never, never>[] };
+    };
+    /** Rules of yours in its export, between the community actions and what we announce, such as a prepend. */
+    export?: readonly PolicyRule<never, never>[];
+    /** What we announce to it. Everything else is rejected. */
+    announce: readonly Announced[];
+    /** Drop RFC 1918 sources arriving from it. `privateDrops()` lists the VLANs. */
+    drop_private?: true;
+};
+
+/** Upstreams by key. The key names everything built from it. */
+export type UpstreamCatalog = Readonly<Record<string, Upstream>>;
+
+/** How each upstream's policies are written: shared by every upstream of a catalog. */
+export type UpstreamPolicies<P extends string> = {
+    /** A policy holding `Bgp.sanity()` that each import calls. The sanity rules are written in each import when absent. */
+    sanity?: P;
+    /** Where a route came from, by upstream: a community or a rule, such as `communityScheme(...).tag(...)`. Nothing is tagged when absent. */
+    tag?: (key: string, upstream: Upstream) => StandardCommunity | LargeCommunity | PolicyRule<never, never>;
+    /** Rules first in each export, such as `communityScheme(...).actions(upstream.asn)`. */
+    actions?: (key: string, upstream: Upstream) => readonly PolicyRule<never, never>[];
+    /** The source address for routes of its family, one per family. */
+    sources?: readonly IP[];
+};
+
+type Key<C> = keyof C & string;
+/** The upstreams that land on a VLAN of ours. */
+type Landed<C> = { [K in Key<C>]: C[K] extends { handoff: object } ? K : never }[Key<C>];
+/** The upstreams that send their VLAN tagged. */
+type Tagged<C> = { [K in Key<C>]: C[K] extends { handoff: { native: number } } ? K : never }[Key<C>];
+/** The upstreams reached over a tunnel. */
+type Tunneled<C> = { [K in Key<C>]: C[K] extends { tunnel: object } ? K : never }[Key<C>];
+/** The upstreams whose sessions share a group: an exchange's route servers, or multihop sessions. */
+type Grouped<C> = { [K in Key<C>]: C[K] extends { role: "rs" } | { multihop: object } ? K : never }[Key<C>];
+/** The upstreams we take routes from. */
+type Importing<C> = { [K in Key<C>]: C[K] extends { import: object } ? K : never }[Key<C>];
+
+/** A native VLAN's name. */
+type Native<K extends string> = `${K}-native`;
+/** Each upstream's policies: `TRANSIT_A-IN` and `TRANSIT_A-OUT`. */
+type PolicyName<C> = `${Uppercase<Importing<C>>}-IN` | `${Uppercase<Key<C>>}-OUT`;
+
+/** The catalog as written, with any key the shape does not have refused, at every level. */
+type Exact<S, T> = T extends readonly unknown[] | string | number | boolean | Secret
+    ? T
+    : { [K in keyof T]: K extends keyof S ? Exact<NonNullable<S[K]>, T[K]> : never };
+
+/** A network's upstreams written once, and each device's part built from them. */
+export class Upstreams {
+    /**
+     * Each upstream written once: its AS, where it lands, its sessions, limits and policy. Everything a device needs is built from it, under names made from each key, so a device that names one is checked:
+     *
+     * - VLAN `<key>`, and `<key>-native` for one that sends its VLAN tagged. The router's interface is `<key>` too, a VLAN interface or a GRE tunnel.
+     * - Policies `<KEY>-IN` and `<KEY>-OUT`; a BGP group `<key>` for an exchange's route servers or multihop sessions.
+     *
+     * On the router: `vlans()`, `interfaces()`, `groups()`, `neighbors()`, `policies({ ... })`, `tunnelRules()`, `addresses()`. On a switch: `vlans(device)`, `ports(device)`, `vlansOn(device)`. For checks and ACLs: `untrusted()`, `natives()`, `privateDrops()`. Lists follow the catalog's order, where order counts on a device.
+     */
+    static define<const C extends UpstreamCatalog>(catalog: C & { [K in keyof C]: Exact<Upstream, C[K]> }) {
+        type V = Landed<C>;
+        type T = Tagged<C>;
+
+        const all = Object.entries(catalog) as [Key<C>, Upstream][];
+        const nameOf = (key: string, upstream: Upstream) => upstream.name ?? key;
+        const policy = (key: string) => key.toUpperCase();
+        const grouped = (upstream: Upstream) => upstream.role === "rs" || Boolean(upstream.multihop);
+
+        /** Each landed upstream's VLAN; with a device, the VLANs and natives of those arriving on its ports. */
+        const vlans = <const D extends string | undefined = undefined>(device?: D) => {
+            const result: Record<string, Vlan> = {};
+
+            for (const [key, upstream] of all) {
+                const handoff = upstream.handoff;
+                if (!handoff || (device !== undefined && handoff.port?.device !== device)) continue;
+
+                result[key] = { id: handoff.vlan, description: nameOf(key, upstream) };
+                if (device !== undefined && handoff.native !== undefined) {
+                    result[`${key}-native`] = {
+                        id: handoff.native,
+                        description: `Native toward ${nameOf(key, upstream)}, nothing else in it`,
+                    };
+                }
+            }
+
+            return result as D extends string ? { [K in V]: Vlan } & { [K in T as Native<K>]: Vlan } : { [K in V]: Vlan };
+        };
+
+        const vlansOn = (device: string) =>
+            all.filter(([, upstream]) => upstream.handoff?.port?.device === device).map(([key]) => key as V);
+
+        const ports = (device: string) => {
+            const result: Record<string, Port<V | Native<T>, never, never, never>> = {};
+
+            for (const [key, upstream] of all) {
+                const handoff = upstream.handoff;
+                if (!handoff?.port || handoff.port.device !== device) continue;
+
+                result[handoff.port.port] = {
+                    description: nameOf(key, upstream),
+                    ...(handoff.native !== undefined
+                        ? { trunk_vlans: [key as V], native_vlan: `${key}-native` as Native<T> }
+                        : { access_vlan: key as V }),
+                    lldp: false,
+                    stp: false,
+                    ...(handoff.port.storm_control ? { storm_control: handoff.port.storm_control } : {}),
+                };
+            }
+
+            return result;
+        };
+
+        const interfaces = () => {
+            const result: Record<string, VlanInterface<V, never> | Gre<never>> = {};
+
+            for (const [key, upstream] of all) {
+                const description = nameOf(key, upstream);
+
+                if (upstream.tunnel) {
+                    const { local, remote, addresses, mtu } = upstream.tunnel;
+                    result[key] = { type: "gre", description, local, remote, addresses, ...(mtu ? { mtu } : {}) };
+                } else if (upstream.handoff) {
+                    const { addresses, exchange } = upstream.handoff;
+                    result[key] = { type: "vlan", vlan: key as V, description, addresses, ...(exchange ? { exchange } : {}) };
+                }
+            }
+
+            return result as { [K in V]: VlanInterface<V, never> } & { [K in Tunneled<C>]: Gre<never> };
+        };
+
+        /** What a session or its group takes from its upstream. */
+        const settings = (key: string, upstream: Upstream): NeighborSettings<PolicyName<C>> => ({
+            remote_as: upstream.asn,
+            description: nameOf(key, upstream),
+            role: upstream.role,
+            ...(upstream.import ? { import: `${policy(key)}-IN` as PolicyName<C> } : {}),
+            export: `${policy(key)}-OUT` as PolicyName<C>,
+        });
+
+        const groups = () =>
+            Object.fromEntries(
+                all
+                    .filter(([, upstream]) => grouped(upstream))
+                    .map(([key, upstream]) => {
+                        const multihop = upstream.multihop;
+                        return [
+                            key,
+                            {
+                                ...settings(key, upstream),
+                                ...(multihop
+                                    ? {
+                                          local_address: multihop.local_address,
+                                          multihop: true,
+                                          ...(multihop.families ? { families: multihop.families } : {}),
+                                          ...(multihop.password ? { password: multihop.password } : {}),
+                                      }
+                                    : {}),
+                            },
+                        ];
+                    })
+            ) as Record<Grouped<C>, NeighborSettings<PolicyName<C>>>;
+
+        const neighbors = () =>
+            Object.fromEntries(
+                all.flatMap(([key, upstream]) =>
+                    Object.entries(upstream.sessions).map(([name, session]) => {
+                        const limit = upstream.limits?.[Address.family(session.address)];
+                        return [
+                            name,
+                            {
+                                ...session,
+                                ...(grouped(upstream) ? { group: key } : settings(key, upstream)),
+                                ...(limit ? { max_prefixes: limit } : {}),
+                            },
+                        ];
+                    })
+                )
+            ) as Record<string, Neighbor<PolicyName<C>, Grouped<C>>>;
+
+        const policies = <const P extends string = never>(options: UpstreamPolicies<P> = {}) => {
+            const result: Record<string, PolicyRule<P, never>[]> = {};
+
+            for (const [key, upstream] of all) {
+                result[`${policy(key)}-OUT`] = [
+                    ...(options.actions?.(key, upstream) ?? []),
+                    ...(upstream.export ?? []),
+                    ...Bgp.announce(upstream.announce),
+                ];
+
+                const taken = upstream.import;
+                if (!taken) continue;
+
+                const tag = options.tag?.(key, upstream);
+                result[`${policy(key)}-IN`] = [
+                    ...(taken.default
+                        ? Bgp.defaultOnly({ ...taken.default, ...(options.sources ? { sources: options.sources } : {}) })
+                        : []),
+                    ...(taken.learn
+                        ? Bgp.learn<P>({
+                              ...(taken.learn.before ? { before: taken.learn.before } : {}),
+                              ...(options.sanity ? { sanity: options.sanity } : {}),
+                              ...(options.sources ? { sources: options.sources } : {}),
+                              ...(taken.learn.local_pref !== undefined ? { local_pref: taken.learn.local_pref } : {}),
+                              ...(tag !== undefined ? { tag } : {}),
+                          })
+                        : [{ description: "Nothing else", action: "reject" as const }]),
+                ];
+            }
+
+            return result as Record<PolicyName<C>, PolicyRule<P, never>[]>;
+        };
+
+        /** The VLANs straight off an upstream, natives included: `untrusted` for `Checks.trustBoundary`. */
+        const untrusted = () => [...all.filter(([, upstream]) => upstream.handoff).map(([key]) => key as V), ...natives()];
+
+        const natives = () =>
+            all.filter(([, upstream]) => upstream.handoff?.native !== undefined).map(([key]) => `${key}-native` as Native<T>);
+
+        const privateDrops = () => all.filter(([, upstream]) => upstream.handoff && upstream.drop_private).map(([key]) => key as V);
+
+        const tunnelRules = (): FilterRule<never, never>[] =>
+            all.flatMap(([key, upstream]) =>
+                upstream.tunnel
+                    ? [
+                          {
+                              description: `GRE from ${nameOf(key, upstream)}`,
+                              match: {
+                                  protocol: "gre" as const,
+                                  src: `${upstream.tunnel.remote}/${Address.bits(Address.family(upstream.tunnel.remote))}` as Prefix,
+                              },
+                              action: "accept" as const,
+                          },
+                      ]
+                    : []
+            );
+
+        const addresses = () => all.flatMap(([, upstream]) => Object.values(upstream.sessions).map((session) => session.address));
+
+        return {
+            vlans,
+            vlansOn,
+            ports,
+            interfaces,
+            groups,
+            neighbors,
+            policies,
+            untrusted,
+            natives,
+            privateDrops,
+            tunnelRules,
+            addresses,
+        };
+    }
+}

package/src/platforms/bgp-wait.ts

@@ -1,4 +1,4 @@
-// Waiting for BGP sessions to be established: `circuit bgp --wait`, and the check after an apply.
+// BGP sessions as `circuit bgp` and the check after an apply read them: waiting for them to be established, and spotting limits that closed several at once.
 
 import { setTimeout as sleep } from "node:timers/promises";
 import type { BgpSession } from "./platform";
@@ -38,4 +38,27 @@ export class BgpWait {
     static upCount(sessions: readonly BgpSession[]): number {
         return sessions.filter((session) => session.established).length;
     }
+
+    /** Sessions closed on their limit within this many minutes of each other are one burst. */
+    static readonly BURST_MINUTES = 5;
+
+    /**
+     * Groups of two or more sessions closed on their limit within `BURST_MINUTES` of each other, earliest first. Several limits at once is usually a leak upstream, not growth, so raising them is the wrong fix.
+     */
+    static limitBursts(sessions: readonly BgpSession[]): BgpSession[][] {
+        const closed = sessions
+            .filter((session) => session.limit?.stoppedAt !== undefined && !Number.isNaN(session.limit.stoppedAt))
+            .sort((a, b) => a.limit!.stoppedAt! - b.limit!.stoppedAt!);
+
+        const bursts: BgpSession[][] = [];
+        for (const session of closed) {
+            const last = bursts.at(-1);
+            const previous = last?.at(-1);
+            if (last && previous && session.limit!.stoppedAt! - previous.limit!.stoppedAt! <= BgpWait.BURST_MINUTES * 60_000)
+                last.push(session);
+            else bursts.push([session]);
+        }
+
+        return bursts.filter((burst) => burst.length > 1);
+    }
 }

package/src/platforms/platform.ts

@@ -58,8 +58,15 @@ export type BgpSession = {
     prefixes: string;
     /** How long it has been up, as the device prints it, or `no session`. */
     uptime: string;
+    /** Why it is down, when the device says: `limit exceeded`, `admin down`, `connecting`. */
+    reason?: string;
+    /** It closed because the neighbor sent more prefixes than its limit, and stays closed until cleared. */
+    limit?: BgpLimit;
 };
 
+/** A session closed on its prefix limit: the limit, and when it closed, as the device prints it and in milliseconds, to compare. */
+export type BgpLimit = { max?: number; stopped?: string; stoppedAt?: number };
+
 /** One BGP log line: when, as the device printed it, such as `2026-10-24 03:12:44`, and the rest of the line. */
 export type BgpLogLine = { at: string; message: string };
 
@@ -115,6 +122,8 @@ export abstract class Platform {
     bgpSessions?(device: Device, session: ReadSession): Promise<BgpSession[]>;
     /** The device's BGP log lines from the last `minutes`, by the device's own clock, read over a `session()`. */
     bgpLog?(session: ReadSession, minutes: number): Promise<BgpLogLine[]>;
+    /** Open again these sessions, each closed on its prefix limit, read by `bgpSessions`. Only a session still closed on its limit is touched. */
+    bgpClearLimit?(session: ReadSession, sessions: readonly BgpSession[]): Promise<void>;
     /**
      * Checks that the device is healthy after an apply, not only that it took the commands. Called before the plan is sent, to read what the checks compare against; the CLI runs them after the apply and the snapshot. Absent on a platform with no checks yet.
      */

package/src/platforms/routeros/TRAPS.md

@@ -12,6 +12,7 @@ Behaviour that looks like something else. Each one has been hit on a real device
 - A session edited repeatedly can stick: SYN both ways, no RST, no log. Remove the connection and add it again.
 - A session that never established is missing from `/routing bgp session print`; look at `/routing bgp connection print`. One that is trying prints `established` empty, not `false`, and no uptime (7.23.5).
 - A BGP session is named `<connection>-<n>`, and a renamed connection keeps its session's old name until the session restarts. `circuit bgp` matches a session by the neighbor's address first.
+- A session closed on its limit keeps its entry with `limit-exceeded=true`, its `input.limit-process-routes` and `last-stopped`, and the notification it sent ends in `0601` (cease, maximum prefixes). Its `prefix-count` is back to 0, so the count that tripped it is gone. `/routing bgp session clear <id> flag=limit-exceeded` opens it again; a misspelled flag is a `syntax error`, and a `find` that matches nothing does nothing (CCR2216, 7.23.5).
 - `time>` in a `/log print` filter does not filter. `circuit bgp --log` keeps the lines of the last minutes itself, against the device's clock.
 - `tcp-md5-key` set from the CLI has been seen discarded without an error, and a mismatch logs nothing. Confirm with `/tool sniffer quick port=179`.
 - Incoming GRE is subject to the input chain. Accept it before testing the tunnel.

package/src/platforms/routeros/index.ts

@@ -70,14 +70,24 @@ export class RouterOs extends Platform {
         "}",
     ].join(" ");
 
-    /** Every BGP session, one line each: name, remote address, established, prefixes received, uptime. One line, because a script sent over exec runs as one. */
+    /**
+     * Every BGP session, one line each: name, remote address, established, prefixes received, uptime, closed on its limit, the limit, when it last closed. Then each disabled connection, `disabled|<name>|<address>`. One line, because a script sent over exec runs as one.
+     */
     private static readonly LIST_BGP_SESSIONS = [
         ":foreach s in=[/routing bgp session find] do={",
         ":local g [/routing bgp session get $s];",
-        ':put (($g->"name") . "|" . ($g->"remote.address") . "|" . ($g->"established") . "|" . ($g->"prefix-count") . "|" . ($g->"uptime"))',
+        ':put (($g->"name") . "|" . ($g->"remote.address") . "|" . ($g->"established") . "|" . ($g->"prefix-count") . "|" . ($g->"uptime") . "|" . ($g->"limit-exceeded") . "|" . ($g->"input.limit-process-routes") . "|" . ($g->"last-stopped"))',
+        "};",
+        ":foreach c in=[/routing bgp connection find disabled] do={",
+        ':put ("disabled|" . [/routing bgp connection get $c name] . "|" . [/routing bgp connection get $c remote.address])',
         "}",
     ].join(" ");
 
+    /** Open again the session from one address, only while it is closed on its limit. */
+    private static clearLimit(address: string): string {
+        return `/routing bgp session clear [find remote.address=${address} and limit-exceeded] flag=limit-exceeded`;
+    }
+
     /**
      * Every LLDP neighbor, one line each: our interfaces, the port first and then the LAG and bridge it is in, the far system name, and the far port as LLDP reports it. `:tostr` keeps the interface list one value; joined to a string as it is, a list repeats the whole line for each of its items. One line, because a script sent over exec runs as one.
      */
@@ -325,32 +335,68 @@ export class RouterOs extends Platform {
 
     /**
      * A session is named `<connection>-<n>`, but a renamed connection keeps its session's old name until the session restarts. So a neighbor is matched by its address first, then by name.
+     *
+     * A session that is down says why: closed on its limit, or still connecting. A neighbor with no session and a disabled connection is admin down.
      */
     async bgpSessions(device: Device, session: ReadSession): Promise<BgpSession[]> {
         const output = await session.run(RouterOs.LIST_BGP_SESSIONS, 60_000);
-        const live = output
+        const lines = output
             .split(/\r?\n/)
             .filter((line) => line.includes("|"))
             .map((line) => line.trim().split("|"));
+        const live = lines.filter(([first]) => first !== "disabled");
+        // A connection's address carries its length, `10.0.0.1/32`.
+        const disabled = lines
+            .filter(([first]) => first === "disabled")
+            .map(([, name, address]) => ({ name, address: address?.split("/")[0] }));
 
-        return Object.entries(device.routing?.bgp?.neighbors ?? {}).map(([name, neighbor]) => {
+        return Object.entries(device.routing?.bgp?.neighbors ?? {}).map(([name, neighbor]): BgpSession => {
             const found =
                 live.find(([, remote]) => remote === neighbor.address) ??
                 live.find(([sessionName]) => sessionName === name || sessionName?.replace(/-\d+$/, "") === name);
 
-            if (!found) return { neighbor: name, remote: "-", established: false, prefixes: "-", uptime: "no session" };
+            if (!found) {
+                const off = disabled.some((connection) => connection.address === neighbor.address || connection.name === name);
+                return {
+                    neighbor: name,
+                    remote: "-",
+                    established: false,
+                    prefixes: "-",
+                    uptime: "no session",
+                    ...(off ? { reason: "admin down" } : {}),
+                };
+            }
+
+            const [, remote, established, prefixes, uptime, limitExceeded, max, stopped] = found;
+            const up = established === "true";
+            const limited = limitExceeded === "true";
 
-            const [, remote, established, prefixes, uptime] = found;
             return {
                 neighbor: name,
                 remote: remote || "-",
-                established: established === "true",
+                established: up,
                 prefixes: prefixes || "-",
                 uptime: uptime || "-",
+                ...(up ? {} : { reason: limited ? "limit exceeded" : "connecting" }),
+                ...(limited
+                    ? {
+                          limit: {
+                              ...(max && /^\d+$/.test(max) ? { max: Number(max) } : {}),
+                              ...(stopped ? { stopped, stoppedAt: RouterOs.logTime(stopped) } : {}),
+                          },
+                      }
+                    : {}),
             };
         });
     }
 
+    async bgpClearLimit(session: ReadSession, sessions: readonly BgpSession[]): Promise<void> {
+        for (const bgp of sessions) {
+            const answer = (await session.run(RouterOs.clearLimit(bgp.remote))).trim();
+            if (answer) throw new Error(`could not clear ${bgp.neighbor}: ${answer.slice(0, 200)}`);
+        }
+    }
+
     /** A `time>` filter in `/log print` does not filter, so the lines are kept here by comparing each one's time with the device's clock. */
     async bgpLog(session: ReadSession, minutes: number): Promise<BgpLogLine[]> {
         const now = (await session.run(RouterOs.CLOCK)).trim();
@@ -501,9 +547,10 @@ export class RouterOs extends Platform {
             return [];
         }
 
-        return down.map(
-            (bgp) =>
-                `BGP session ${bgp.neighbor} was established before the apply and is not ${limits.seconds} s after it (${bgp.uptime === "no session" ? "no session" : "not established"}). Look with: circuit bgp ${device.name} --log`
+        return down.map((bgp) =>
+            bgp.limit
+                ? `BGP session ${bgp.neighbor} was established before the apply and closed on its limit${bgp.limit.max !== undefined ? ` of ${bgp.limit.max} prefixes` : ""}: the neighbor sends more than it may. Find out why, then: circuit bgp ${device.name} ${bgp.neighbor} --clear-limit`
+                : `BGP session ${bgp.neighbor} was established before the apply and is not ${limits.seconds} s after it (${bgp.reason ?? (bgp.uptime === "no session" ? "no session" : "not established")}). Look with: circuit bgp ${device.name} --log`
         );
     }