EIGRP Packets explained

(Rene Molenaar) #1

This topic is to discuss the following lesson:

(Rene Molenaar) #2

Hello I found little mistake in text:
As you can see router Lizzy is sending 3 hello packets meant for router Jack, John and Lizzy.
Should be:
As you can see router Lizzy is sending 3 hello packets meant for router Jack, John and James.

(Rene Molenaar) #3

Thanks Towdie, just fixed it!

(system) #4

it was really helpfull,
thanks!!

(system) #5

thank you! that was very helpful.
additionally:
query messages are multicast but reply messages are unicast.
this is what i see on wireshark.

(Thomas K) #6

Rene,
Hi. Are query messages always multicast (even if have static neighbor)? Are Reply messages always unicast?

Many thanks,
Thomas

(Rene Molenaar) #7

Hi Thomas,

If you use static neighbors then everything will be unicast, here’s a wireshark capture of two EIGRP routers that become neighbors:

https://www.cloudshark.org/captures/58a4f297515f

The query message is normally send using multicast unless a neighbor doesn’t send an ACK in return. In that case, the retransmitted query message will be sent using unicast. The reply is always unicast.

Rene

(Hussein Samir) #8

Hi Rene,

I have some vague about full update and partial update ?
Do you mean :-
1 - The full update always send using unicast after neighbor adjacency formed ?
2 - The partial update always send using multicast when there is a change in the topology ? and if we use static neighbors the partial update will be sent using unicast ? that’s right ?
If there is wrong correct me please ?

thanks

(Rene Molenaar) #9

Hi Hussein,

When you use static neighbors, it’s 100% unicast. Here’s a capture where you can see this:

https://www.cloudshark.org/captures/58a4f297515f

Here’s an example where we use the default neighbor discovery (multicast):

https://www.cloudshark.org/captures/bdcc74327b71

The initial (full) update messages are sent using unicast, the other update messages (partial updates) are sent with multicast. These are used for things like metric changes.

Rene

(Muktar K) #10

Hello new member,

I wanted to know which of the eigrp packets is / are only unicast. Could we consider ACK and Hello too.

Thanks
Muktar

(Rene Molenaar) #11

Hi Muktar,

The answer can be found in a packet capture. Take a look at this one:

EIGRP v9 Neighbor Adjacency Packet Capture

Rene

(clement d) #12

what about the Request packets ? Still not sure what it does,

defined as : “Request packets are used to get specific information from one or more neighbors. Request packets are used in route server applications. They can be multicast or unicast. Requests are transmitted unreliably.”

Can you tell us more ? Thanks !

(Lazaros Agapides) #13

Hello Clement.

There are differing opinions as to how many and what type of EIGRP packets exist. Some refer to five, others to six. Some group Request packets and Query packets together. Some group ACK and Hello packets together (since ACK is basically an empty hello packet). Some just don’t mention Request packets. It really depends on who you ask.

Cisco’s official documentation states that there are five packet types:

* Hello/Acks
* Updates
* Queries
* Replies
* Requests

Although Cisco’s official CCNA curriculum gives the following list:

* Hello
* Acknowledgements
* Updates
* Queries
* Replies

In any case, a request packet is similar to a query packet, except for the fact that query packets are sent reliably while request packets are not. Request packets can be both unicast or multicast and are initially sent when an EIGRP router joins an EIGRP AS and requests information from neighbours.

Cisco also says that these packets are used in route server applications. A route server is a troubleshooting device within an Autonomous System that is able to view the IP routing tables of all participating routers. It can be used to determine routing faults and to correct routing malfunctions. So request packets are used for such applications.

The truth is it is not very clear, but I hope that this makes it somewhat clearer for you.

I hope this has been helpful!

Laz

(Chris N) #14

Are Hello’s unicast or multicast on a serial link? (point to point)

(Lazaros Agapides) #15

Hello Chris

Even over a serial link, EIGRP will send hello packets to the multicast address. It is good practice however to stop multicast EIGRP hellos over point to point links by explicitly indicating the EIGRP neighbour that you will use within the EIGRP configuration. If for example you have two routers connected via a serial link and the IP addresses on either end are 172.16.5.1 for the serial 0/0 interface of Router 1 and and 172.16.5.2 for the serial 0/0 interface on Router 2, then you can specify the neighbour over that link with the following commands:

On Router 1

R1#configure terminal
R1(config)#router eigrp 1
R1(router-config)#neighbor 172.16.5.2 Serial0/0
R1(router-config)#

On Router 2

R2#configure terminal
R2(config)#router eigrp 1
R2(router-config)#neighbor 172.16.5.1 Serial0/0
R2(router-config)#

This will cause the two routers to become neighbours and exchange hellos using unicast instead of multicast.

I hope this has been helpful!

Laz

(Heng S) #16

Hi
I’m bit confuse about Acknowledgements.
ACK packets are used to acknowledge the receipt of update, query and reply packets.
In case it use to acknowledge the receipt of query, does the router will send ACK first or it send Reply fist or it will send ACK and Reply in the same time ?

(Rene Molenaar) #17

Hi Heng,

You can see this with a quick Wireshark capture: eigrp-query-reply.pcapng

These are two routers using IP addresses 192.168.12.1 and 192.168.12.2

Once 192.168.12.1 loses a route (1.1.1.1/32), it sends the query to 192.168.12.2.

192.168.12.2 first responds to the query with an ACK. Wireshark shows the ACK as Hello (5), don’t let this confuse you…this happens because the EIGRP hello and ACK packet both share the same opcode.

192.168.12.2 responds with a reply, which is ACKed by 192.168.12.1 as well.

I hope this helps!

Rene

(Prashant C) #18

Hello Rene,
i videos you have mentioned , 1.1.1.1 in topolgy table as successor. as per my understanging EIGRP tology table does nit contains successor route, please correct me if i am wrong

(Lazaros Agapides) #19

Hello Prashant

A Successor as far as EIGRP is concerned, is the best path to get to a particular network. The successor is indeed found in the EIGRP topology table, and it is the route to the destination in question that is actually installed within the routing table.

I hope this has been helpful!

Laz