Packet Captures
rpvstp-access.pcap.cap 3.7 KB
Submitted Dec 16, 2009 by einval
Rapid per-VLAN spanning tree capture of an access port (without portfast), configured in VLAN 5.
DNS Ethernet IP LLC LOOP STP UDP
| Packets: 49 | Duration: 77s | Downloads: 9165 |
LDP_Ethernet_FrameRelay.pcap.cap 2.1 KB
Submitted Dec 5, 2009 by pierky
LDP with pseudowire FEC elements (Ethernet and Frame-Relay DLCI-to-DLCI)
| Packets: 14 | Duration: 7s | Downloads: 9652 |
EoMPLS.cap 7.0 KB
Submitted Oct 12, 2009 by pierky
Routers at 1.1.2.1 and 1.1.2.2 are PEs in a MPLS cloud. LDP starts at packet 8 and they build up a pseudo-wire VC (last FEC in packets 11 and 13). At packet 15 we already have STP running between CE1 and CE2 (two routers with ESW), encapsulated in 2 MPLS headers. All the ethernet stuff follows: CDP, ARP, ICMP between two hosts on the same subnet.
| Packets: 56 | Duration: 32s | Downloads: 11498 |
DHCP_Inter_VLAN.cap 2.0 KB
Submitted Sep 30, 2009 by pierky
R1 is a router-on-a-stick. It receives a DHCP Discover on the trunk interface, it sets the "Relay agent IP address" to the sub-interface's IP address it received the packet on and, finally, it forwards it to the DHCP server. Capture perspective is R1-DHCP server link.
| Packets: 4 | Duration: n/a | Downloads: 11392 |
DHCP.cap 5.8 KB
Submitted Sep 29, 2009 by pierky
R0 is the client and R1 is the DHCP server. Lease time is 1 minute.
| Packets: 12 | Duration: 153s | Downloads: 11468 |
TDP.cap 2.8 KB
Submitted Sep 14, 2009
P2 and PE2 exchange Tag Distribution Protocol hellos and form an adjacency over TCP port 711.
| Packets: 33 | Duration: 47s | Downloads: 6408 |
SNMPv2c_get_requests.cap 894 bytes
Submitted Sep 14, 2009
SNMPv2c get requests are issued from a manager to an SNMP agent in order to monitor the bandwidth utilization of an interface.
| Packets: 8 | Duration: n/a | Downloads: 8085 |
RIPv2_subnet_down.cap 1.3 KB
Submitted Sep 14, 2009
RIPv2 routes are being flooded on the R1-R2 link. R2's connection to 192.168.2.0/24 goes down, and the route is advertised as unreachable (metric 16) in packet #7. Capture perspective from R1's 10.0.0.1 interface.
| Packets: 10 | Duration: 86s | Downloads: 8552 |
RIPv2.cap 1.7 KB
Submitted Sep 14, 2009
A RIPv2 router periodically flooding its database. Capture perspective from R1's 10.0.0.1 interface.
| Packets: 12 | Duration: 141s | Downloads: 10402 |
RIPv1_subnet_down.cap 1.0 KB
Submitted Sep 14, 2009
RIPv1 routes are being flooded on the R1-R2 link. R2's connection to 192.168.2.0/24 goes down, and the route is advertised as unreachable (metric 16) in packet #5. Capture perspective from R1's 10.0.1.1 interface.
| Packets: 8 | Duration: 58s | Downloads: 6518 |
RIPv1.cap 876 bytes
Submitted Sep 14, 2009
A RIPv1 router periodically flooding its database. Capture perspective from R1's 10.0.1.1 interface.
| Packets: 6 | Duration: 65s | Downloads: 7673 |
RADIUS.cap 775 bytes
Submitted Sep 14, 2009
A RADIUS authentication request is issued from a switch at 10.0.0.1 on behalf of an EAP client. The user authenticates via MD5 challenge with the username "John.McGuirk" and the password "S0cc3r".
| Packets: 4 | Duration: n/a | Downloads: 15696 |
PIM-DM_pruning.cap 10.2 KB
Submitted Sep 14, 2009
The multicast source at 172.16.40.10 begins sending traffic to the group 239.123.123.123, and PIM-DM floods the traffic down the tree. R4 has no group members, and prunes itself from the tree. R2 and R3 then realize they have no members, and each prunes itself from the tree. The capture shows R2 receiving the multicast traffic flooded from R1 and subsequently pruning itself every three minutes.
| Packets: 38 | Duration: 415s | Downloads: 7053 |
path_MTU_discovery.cap 6.2 KB
Submitted Sep 14, 2009
Tracepath is used to determine the MTU of the path between hosts 192.168.0.2 and .1.2. Packet #6 contains an ICMP "fragmentation needed" message, indicating the MTU for that hop is 1400 bytes.
| Packets: 8 | Duration: n/a | Downloads: 13106 |
LDP_adjacency.cap 5.7 KB
Submitted Sep 14, 2009
PE1 and P1 multicast LDP hellos to 224.0.0.2 on UDP port 646. They then establish an adjacency on TCP port 646 and exchange labels.
| Packets: 61 | Duration: 108s | Downloads: 9751 |
ISAKMP_sa_setup.cap 2.0 KB
Submitted Sep 14, 2009
An ISAKMP session is established prior to setting up an IPsec tunnel. Phase one occurs in main mode, and phase two occurs in quick mode.
| Packets: 9 | Duration: n/a | Downloads: 12247 |
HSRP_failover.cap 3.0 KB
Submitted Sep 14, 2009
R1 is the active router, R3 is the standby, and R2 is passive. R1 goes offline and R3 takes over as active after ten seconds. R2 is then promoted to the standby state.
| Packets: 39 | Duration: 47s | Downloads: 7592 |
HSRP_election.cap 3.7 KB
Submitted Sep 14, 2009
The Ethernet link shared by routers 1, 2, and 3 comes online. R1 wins the HSRP election because it has a priority of 200 (versus the default of 100 held by the other two routers). R3 becomes the standby router.
| Packets: 49 | Duration: 57s | Downloads: 7038 |
HSRP_coup.cap 3.9 KB
Submitted Sep 14, 2009
Initially only routers 3 (active) and 2 (standby) are online. R1 comes online with a priority higher than R3's. R1 takes over as the active router (the coup occurs in packet #22) almost immediately. R2 is bumped down to passive and R3 becomes the standby router.
| Packets: 51 | Duration: 49s | Downloads: 6245 |
GLBP_election.cap 8.4 KB
Submitted Sep 14, 2009
Routers 1, 2, and 3 participate in a GLBP election. R1 becomes the AVG due to having the highest priority (200), and R3 becomes the standby GLBP. All three routers become AVFs.
| Packets: 80 | Duration: 68s | Downloads: 6057 |
Auto-RP.cap 726 bytes
Submitted Sep 14, 2009
Routers 2 and 3 have been configured as candidate RPs, and multicast RP announcements to 239.0.1.39. Router 1 is the RP. R1 sees the candidate RP announcements from R2 and R3, and designates R3 the RP because it has a higher IP address (3.3.3.3). R1 multicasts the RP mapping to 224.0.1.40. The capture is from the R1-R2 link.
| Packets: 9 | Duration: 239s | Downloads: 6365 |