TTL 2 of EIGRP and RIP Packets Explained

If you ever looked at the wireshark capture of EIGRP or RIP packets you might have seen that the TTL (Time to Live) value is 2. You would probably expect to see a TTL of 1 here since these multicast packets aren’t routed between subnets. In this tutorial I’ll show you why these packets have a TTL of 2.

To demonstrate this I will use the following frame-relay hub and spoke topology:

 

Frame-relay hub and spoke

We have one hub router and two spoke routers. First I’ll configure frame-relay using the physical interfaces and a single subnet:

Hub(config)#interface serial 0/0  
Hub(config-if)#encapsulation frame-relay
Hub(config-if)#ip address 192.168.123.1 255.255.255.0
Hub(config-if)#no shutdown
Spoke1(config)#interface serial 0/0
Spoke1(config-if)#encapsulation frame-relay
Spoke1(config-if)#ip address 192.168.123.2 255.255.255.0
Spoke1(config-if)#no shutdown
Spoke2(config)#interface serial 0/0
Spoke2(config-if)#encapsulation frame-relay
Spoke2(config-if)#ip address 192.168.123.3 255.255.255.0
Spoke2(config-if)#no shutdown

We’ll configure EIGRP on all routers:

Hub, Spoke1 & Spoke2:
(config)#router eigrp 123
(config-router)#network 192.168.123.0

We now have a neighbor adjacency between Hub/Spoke1 and Hub/Spoke2. Let’s take a look at an EIGRP capture in wireshark to see what the TTL looks like:

EIGRP Multicast Packet TTL 2

As you can see the TTL is 2 but why? A TTL of 1 would be enough since these packets aren’t routed between subnets. The answer to this question is that we need it for communication between spoke routers.

To demonstrate this we will configure spoke1 and spoke2 to become EIGRP routers and take a look at the wireshark capture again. Before the spoke routers can become neighbors they’ll require a frame-relay mapping:

Spoke1(config)#interface serial 0/0
Spoke1(config-if)#frame-relay map ip 192.168.123.3 201
Spoke2(config)#interface serial 0/0
Spoke2(config-if)#frame-relay map ip 192.168.123.2 301

Spoke1 and spoke2 are now able to reach each other. We will use the EIGRP neighbor command to make sure all routers become neighbors with each other:

Hub(config)#router eigrp 123
Hub(config-router)#neighbor 192.168.123.2 serial 0/0
Hub(config-router)#neighbor 192.168.123.3 serial 0/0
Spoke1(config)#router eigrp 123
Spoke1(config-router)#neighbor 192.168.123.1 serial 0/0
Spoke1(config-router)#neighbor 192.168.123.3 serial 0/0
Spoke2(config)#router eigrp 123
Spoke2(config-router)#neighbor 192.168.123.1 serial 0/0
Spoke2(config-router)#neighbor 192.168.123.2 serial 0/0

As you can see the spoke routers have become neighbors:

Spoke1#
%DUAL-5-NBRCHANGE: IP-EIGRP(0) 123: Neighbor 192.168.123.1 (Serial0/0) is up: new adjacency
Spoke2#
%DUAL-5-NBRCHANGE: IP-EIGRP(0) 123: Neighbor 192.168.123.2 (Serial0/0) is up: new adjacency

Let’s get back to wireshark and look at an EIGRP packet from spoke1 to spoke2. The first capture is an hello packet that the Hub receives from spoke1:

EIGRP Spoke TTL 2

As you can see this IP packet is sent from spoke1 to spoke2 and it has been received on DLCI 102 on the hub router, it has a TTL of 2. This packet will be forwarded by the hub router to spoke2 and it will look like this:

We're Sorry, Full Content Access is for Members Only...

If you like to keep on reading, Become a Member Now! Here is why:

  • Learn any CCNA, CCNP and CCIE R&S Topic. Explained As Simple As Possible.
  • Try for Just $1. The Best Dollar You've Ever Spent on Your Cisco Career!
  • Full Access to our 657 Lessons. More Lessons Added Every Week!
  • Content created by Rene Molenaar (CCIE #41726)

528 Sign Ups in the last 30 days

satisfaction-guaranteed
100% Satisfaction Guaranteed!
You may cancel your monthly membership at any time.
No Questions Asked!

Tags:


Forum Replies

  1. I’m sorry but i don’t really agree with what you say. Your example starts with a multicast link-local ip address as destination. It has to be with TTL1.

    When you establish static neighborship instead, your packet becomes a unicast.

    The answer to this i guess, is programmers laziness. Is easier to keep the packet as is and just change the destination ip address rather than changing ip address and ttl. From a “c” developer point of view, you will not need to define a “ttl variable” and “set up a “setsockopt” call” … less code, less errors can be made.

  2. Hi Andrea,

    Thanks for your message. I think it’s common practice to set the TTL of link local multicast packets to 1 but it’s not written down in any standard. Only thing I could find about this is a draft: http://mirror.physik-pool.tu-berlin.de/pub/ietf/ietf-tools.html/draft-asati-eckert-multicast-local-ttl-00.html.

    The TTL of eigrp packets (unicast or multicast) is 2 so the only thing I could think of was the spoke to spoke communication as the hub decrements the TTL by 2.

    Rene

  3. Rene is correct. Just because the neighbor statement is used with an IGP does not modify it’s TTL. Whether RIP or EIGRP are sending their hellos/updates via multicast or unicast, the TTL is 2 in both cases. For OSPF, PIM, and LDP, it’s always 1.

    If you used the neighbor statement with OSPF, the TTL remains 1. So, simply by modifying the behavior of the IGP does not modify the packet’s TTL.

    The reason behind this is to still maintain neighborships across NBMA networks, including DMVPN, for distance vector routing protocols WITHOUT having to disable split horizon

    ... Continue reading in our forum

  4. With any of the OSPF “point-to-xxxx” network types, the spoke routers will become neighbors with the Hub router.

    When one spoke router advertises something to the hub then the hub will create a new IP packet with a LSA and sends it to the other spoke. This IP packet will have a TTL of 1.

  5. Hello Rene,

    I captured packets in wireshark for eigrp over framerelay for both dynamic and static neighbor. But the TTL is always 1. So in case of static neighbor spoke to spoke neighbor ship did not ever happen. Also HUB sending the message to spoke “Time to Live Exceeded”. My spoke to spoke inverse arp is working. I am using 7200 IOS 15.2 router. Please have a look at this.

    Thanks

11 more replies! Ask a question or join the discussion by visiting our Community Forum