Packet Captures
OSPF_LSA_types.cap 4.0 KB
Submitted Sep 14, 2009
Capture of adjacency formation between OSPF routers 4 and 5 in area 20. Packet #12 contains LSAs of types 1, 2, 3, 4, and 5.
| Packets: 30 | Duration: 63s | Downloads: 12220 |
OSPF_broadcast_adjacencies.cap 8.4 KB
Submitted Sep 14, 2009
Three routers form OSPF adjacencies across a broadcast segment. All interface priorities are left default, so R3 (with the highest router ID) becomes the DR, and R2 (with the next-highest router ID) becomes the BDR. Capture perspective from R1.
| Packets: 74 | Duration: 95s | Downloads: 9943 |
OSPFv3_with_AH.cap 10.7 KB
Submitted Sep 14, 2009
The adjacency between R1 and R2 in the 2001:db8:0:12::/64 subnet is configured with IPsec AH authentication. Note the inclusion of an IPsec AH header immediately following the IPv6 header of each OSPF packet.
| Packets: 61 | Duration: 170s | Downloads: 8643 |
OSPFv3_NBMA_adjacencies.cap 12.9 KB
Submitted Sep 14, 2009
Router 3 forms OSPFv3 adjacencies with routers 1 and two across the non-broadcast multi-access (NBMA) frame relay link.
| Packets: 86 | Duration: 90s | Downloads: 6457 |
OSPFv3_multipoint_adjacencies.cap 11.5 KB
Submitted Sep 14, 2009
The frame relay link connecting routers 1, 2, and 3 has been configured as a point-to-multipoint network with broadcast capability. Router 3 forms OSPFv3 adjacencies with routers 1 and 2, but no DR or BDR is elected.
| Packets: 73 | Duration: 35s | Downloads: 6560 |
OSPFv3_broadcast_adjacency.cap 5.4 KB
Submitted Sep 14, 2009
Routers 1 and 2 form an OSPFv3 adjacency across their common Ethernet link (2001:db8:0:12::/64).
| Packets: 38 | Duration: 70s | Downloads: 7492 |
mtrace.cap 238 bytes
Submitted Sep 14, 2009
mtrace 172.16.40.1 172.16.20.1 is issued on R1 to trace the RPF path from R4's 172.16.20.0/24 subnet to R1's 172.16.40.0/24 subnet. The capture is taken on the R1-R3 link.
| Packets: 2 | Duration: n/a | Downloads: 6169 |
MSDP.cap 4.1 KB
Submitted Sep 14, 2009
R2 and R3 become MSDP peers and exchange keepalives. A multicast source 172.16.40.10 begins sending traffic to group 239.123.123.123, and R2 begins sending periodic source active messages to R3. Capture perspective is the R2-R3 link.
| Packets: 35 | Duration: 391s | Downloads: 6326 |
mrinfo_query.cap 182 bytes
Submitted Sep 14, 2009
mrinfo 2.2.2.2 is issued on R1. DVMRPv3 is used to query R2 for its multicast interfaces.
| Packets: 2 | Duration: n/a | Downloads: 5638 |
LDP_adjacency.cap 5.7 KB
Submitted Sep 14, 2009
PE1 and P1 multicast LDP hellos to 224.0.0.2 on UDP port 646. They then establish an adjacency on TCP port 646 and exchange labels.
| Packets: 61 | Duration: 108s | Downloads: 9751 |
ISIS_p2p_adjacency.cap 21.7 KB
Submitted Sep 14, 2009
Routers 1 and 2 form a L1/L2 adjacency over a point-to-point serial link. Note that both levels of adjacency are managed with a point-to-point (P2P) hello.
| Packets: 26 | Duration: 113s | Downloads: 10149 |
ISIS_level2_adjacency.cap 51.8 KB
Submitted Sep 14, 2009
Routers 3 and 4 form an IS-IS level 2 adjacency.
| Packets: 43 | Duration: 85s | Downloads: 9054 |
ISIS_level1_adjacency.cap 27.4 KB
Submitted Sep 14, 2009
Routers 2 and 3 form an IS-IS level 2 adjacency.
| Packets: 22 | Duration: 58s | Downloads: 7950 |
ISIS_external_lsp.cap 17.0 KB
Submitted Sep 14, 2009
R2 floods the external routes redistributed from RIP into area 10. Packet #9 includes the IP external reachability TLV. Capture perspective from R3's 10.0.10.1 interface.
| Packets: 15 | Duration: 23s | Downloads: 6962 |
IBGP_adjacency.cap 2.3 KB
Submitted Sep 14, 2009
Routers 3 and 4 form an internal BGP relationship. This is evidenced by the OPEN messages in packets #4 and #5, which show both routers belong to the same AS (65300). Also note that IBGP packets are not subject to a limited TTL as are EBGP packets.
| Packets: 17 | Duration: 63s | Downloads: 7940 |
EIGRP_subnet_up.cap 1.3 KB
Submitted Sep 14, 2009
R4's 192.168.4.0/24 subnet is brought online. R1 receives updates from both R2 and R3 (only R2's update is shown in the capture). The poison-reverse in packet #9 informs R2 not to use R1 as a path to 192.168.4.0/24. The capture perspective is from R1's 10.0.0.1 interface.
| Packets: 15 | Duration: 18s | Downloads: 8055 |
EIGRP_subnet_down.cap 1.8 KB
Submitted Sep 14, 2009
R4's interface to 192.168.4.0/24 goes down and the route is advertised as unreachable. Queries are issued by all routers to find a new path to the subnet but none exists, and the route is removed from the topology. Capture perspective is from R1's 10.0.0.1 interface.
| Packets: 21 | Duration: 23s | Downloads: 6065 |
EIGRP_goodbye.cap 1.3 KB
Submitted Sep 14, 2009
R2 designates its interface facing R1 as passive. The final hello message from R2 (packet #9) has all its K values set to 255, designating the message as a "goodbye." Capture perspective is from R1's 10.0.0.1 interface.
| Packets: 15 | Duration: 43s | Downloads: 7669 |
EIGRP_adjacency.cap 5.1 KB
Submitted Sep 14, 2009
Formation of an EIGRP adjacency between routers R1 and R2. Capture point is R1's 10.0.0.1 interface.
| Packets: 53 | Duration: 104s | Downloads: 10287 |
EIGRPv2_subnet_transition.cap 5.3 KB
Submitted Sep 14, 2009
R4's 2001:db8:0:400::/64 subnet goes down, then comes back up roughly thirty seconds later. Capture perspective from R1's 2001:db8:0:12::1 interface.
| Packets: 49 | Duration: 65s | Downloads: 6243 |
EIGRPv2_adjacency.cap 4.1 KB
Submitted Sep 14, 2009
Routers 1 and 2 form an EIGRPv2 adjacency and exchange IPv6 routes.
| Packets: 31 | Duration: 52s | Downloads: 8046 |
EBGP_adjacency.cap 2.7 KB
Submitted Sep 14, 2009
The external BGP adjacency between routers 1 and 2 is brought online and routes are exchanged. Keepalives are then exchanged every 60 seconds. Note that the IP TTL (normally 1) has been increased to 2 with ebgp-multihop to facilitate communication between the routers' loopback interfaces.
| Packets: 24 | Duration: 182s | Downloads: 8162 |
BGP_soft_reset.cap 2.0 KB
Submitted Sep 14, 2009
R1 performs a soft bidirectional reset (clear ip bgp soft) on its adjacency with R2. The ROUTE-REFRESH message is visible in packet #7. Note that the TCP connection remains uninterrupted, and neither router views the reset as disruptive.
| Packets: 17 | Duration: 180s | Downloads: 6761 |
BGP_notification.cap 764 bytes
Submitted Sep 14, 2009
R1 has been misconfigured to expect R2 to reside in AS 65100. R2 attempts to peer with R1 advertising itself correctly in AS 65200. R1 issues a NOTIFICATION in packet #5 citing a "bad peer AS" error and terminates the TCP connection.
| Packets: 9 | Duration: n/a | Downloads: 7022 |
BGP_hard_reset.cap 3.2 KB
Submitted Sep 14, 2009
A hard reset (clear ip bgp) is performed on R1 for its adjacency with R2. Packet #7 shows R1 sending a packet with the TCP FIN flag set, indicating the connection is to be torn down. The TCP connection is then reestablished and UPDATEs are retransmitted.
| Packets: 32 | Duration: 208s | Downloads: 6656 |