Hello Juan
This here is the part of the cloudshark capture you are referring to:
Now the interesting thing is that I have been going through some of the PIM RFCs, and looking at the header structure of the PIM register message (which is type 1 as seen in the Type field). I haven’t been able to find any information about the PIM Options fields! The flags are not defined, and they don’t seem to exist in the RFC. If anyone has any info about this, please feel free to post!
I personally believe that the flags in the PIM message indicate the IP version of the original multicast packet, so it means that the PIM is encapsulating an IPv4 multicast packet.
The Register-Stop message, as you mentioned, doesn’t contain any payload. It’s sent by the RP to the DR to signal that it should stop sending Register messages for a particular source/group pair. This happens when the RP has learned about the source via the normal multicast routing process.
As for your question about Tunnel0 and Tunnel1, these are commonly used in PIM implementations to handle PIM Register messages. Tunnel0 is typically used on the DR to encapsulate the original multicast packet within the PIM Register message, while Tunnel1 is used on the RP to decapsulate the original packet from the PIM Register message.
I hope this has been helpful!
Laz