EIGRP Static Neighbor Unicast Hello Packet Capture

This packet capture shows EIGRP between two Cisco routers that are configured with static neighbors (the neighbor command). Normally EIGRP sends its Hellos to the multicast address 224.0.0.10. With static neighbors, everything is unicast: Hellos, Updates and ACKs all go straight to the neighbor’s IP address. You also see the adjacency being built: the Init flag exchange, the routing table exchange that ends with End of Table, and the acknowledgments.

The EIGRP static neighbor lesson explains when you need the neighbor command and how to configure it, and EIGRP packets explained covers all packet types. For the reliable transport between established neighbors, see the EIGRP Query and Reply Packet Capture. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

File	eigrp-unicast-neighbors.pcap
Packets	22
Protocol	EIGRP (RFC 7868), IP protocol 88, classic mode, AS 12
Devices	Cisco IOS 12.4: R1 192.168.12.1 and R2 192.168.12.2, both with neighbor statements
Wireshark filter	eigrp or eigrp && ip.dst != 224.0.0.10

Packets in this capture

No. Time       Source        Destination   Info
1   0.000000   192.168.12.2  192.168.12.1  Hello
2   1.128786   192.168.12.1  192.168.12.2  Hello
...
7   22.761723  192.168.12.2  192.168.12.1  Update (Init)    seq 5
11  25.406332  192.168.12.1  192.168.12.2  Update (Init)    seq 5
12  25.755967  192.168.12.2  192.168.12.1  Update (Init)    seq 5, ack 5
13  25.766286  192.168.12.1  192.168.12.2  Update (End of Table) seq 6
14  25.776501  192.168.12.1  192.168.12.2  Hello (Ack)          ack 5
15  25.807105  192.168.12.2  192.168.12.1  Update (End of Table) seq 6, ack 6
16  25.817311  192.168.12.1  192.168.12.2  Update (End of Table) seq 7, ack 5
17  25.827475  192.168.12.2  192.168.12.1  Hello (Ack)          ack 7
18  25.827475  192.168.12.1  192.168.12.2  Hello (Ack)          ack 6
19  25.848013  192.168.12.2  192.168.12.1  Update (End of Table) seq 8, ack 7
20  25.858237  192.168.12.1  192.168.12.2  Hello (Ack)          ack 8
21  30.057121  192.168.12.1  192.168.12.2  Hello
22  30.097649  192.168.12.2  192.168.12.1  Hello

Every packet in this capture goes to a unicast address. There’s not a single packet to 224.0.0.10.

Packet walkthrough

Unicast Hello (packet 1)

Internet Protocol Version 4, Src: 192.168.12.2, Dst: 192.168.12.1
    Total Length: 60
    Time to Live: 2
    Protocol: EIGRP (88)
Cisco EIGRP
    Version: 2
    Opcode: Hello (5)
    Checksum: 0xeec0 [correct]
    Flags: 0x00000000
    Sequence: 0
    Acknowledge: 0
    Virtual Router ID: 0 (Address-Family)
    Autonomous System: 12
    Parameters
        Type: Parameters (0x0001)
        Length: 12
        K1: 1
        K2: 0
        K3: 1
        K4: 0
        K5: 0
        K6: 0
        Hold Time: 15
    Software Version: EIGRP=12.4, TLV=1.2
        Type: Software Version (0x0004)
        Length: 8
        EIGRP Release: 12.04
        EIGRP TLV version: 1.02

• Destination 192.168.12.1: with neighbor 192.168.12.1 <interface> configured, the router sends its Hellos as unicast to that address only. It also stops sending and processing multicast Hellos on that interface. That’s why you need static neighbors on links that can’t carry multicast, like Frame Relay without the broadcast keyword, or when you want EIGRP to talk only to specific routers.
• TTL 2: these unicast Hellos aren’t sent with TTL 1. Static EIGRP neighbors still have to be on a directly connected subnet, though. You can’t use the neighbor command for a router several hops away.
• Autonomous System 12: must match on both sides.
• K1 = 1, K3 = 1: the default K-values, so the metric uses bandwidth and delay only. Neighbors with different K-values won’t form an adjacency.
• Hold Time 15: the default on Ethernet (3 × the 5-second Hello interval). You can see the roughly 5-second Hello interval in the packet times.
• Software Version 12.4: classic EIGRP on IOS 12.4. That’s why the route TLVs later in the capture use the old format.

Building the adjacency: Init (packets 7, 11 and 12)

Hellos alone don’t make an adjacency. The routers have to exchange an Update with the Init flag and acknowledge each other’s:

Cisco EIGRP
    Opcode: Update (1)
    Flags: 0x00000001, Init
        .... .... .... .... .... .... .... ...1 = Init: Set
    Sequence: 5
    Acknowledge: 0

R2 sends its first Init Update in packet 7. R1 sends its own Init in packet 11. In packet 12, R2 sends Init again, this time with Acknowledge 5, acknowledging R1’s Init. The Init exchange is how both routers confirm that unicast traffic works in both directions before they trade routes.

Exchanging routes: End of Table (packets 13-20)

Cisco EIGRP
    Opcode: Update (1)
    Flags: 0x00000008, End Of Table
        .... .... .... .... .... .... .... ...0 = Init: Not set
    Sequence: 6
    Acknowledge: 0
    Virtual Router ID: 0 (Address-Family)
    Autonomous System: 12
    Internal Route(IPv4)  =   1.1.1.0/24
        Type: Internal Route(IPv4) (0x0102)
            Scaled Delay: 128000
            Route Tag: 0
        Destination: 1.1.1.0

• End Of Table flag: “this is the last Update of my initial routing table”. The neighbor knows the initial exchange is complete.
• Type 0x0102: the classic IPv4 internal route TLV with 32-bit metrics. Compare it with type 0x0602 (multi-protocol, wide metrics) in the EIGRP Query and Reply capture, which uses named mode.
• Updates and ACKs: every Update has a sequence number and gets acknowledged, either with an ACK (a Hello with only the Acknowledge field set, like packets 14, 17, 18 and 20) or piggybacked in the neighbor’s own Update.

After packet 20, the adjacency is up and both routers go back to sending unicast Hellos every 5 seconds.