395 Free Cisco Lessons - No credit card neededSign up for Free
You are here: Home » Packet Captures

L2TPv3 Control Connection and Session Setup Packet Capture

This packet capture shows two Cisco routers building an L2TPv3 pseudowire: first the control connection (SCCRQ, SCCRP, SCCCN), then the session for the Ethernet circuit (ICRQ, ICRP, ICCN). Before that, there’s a collision: both routers try to start a control connection at the same time, and a tie breaker decides which one survives.

All of it happens in 15 control messages. Along the way you see how each router hands out its own connection and session IDs, and how Ns/Nr sequence numbers make the control channel reliable without TCP. The L2TPv3 lesson shows the xconnect configuration and the data plane. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

File l2tpv3-tunnel-establishment.pcapng
Packets 15 control messages
Protocol L2TPv3 (RFC 3931) with Cisco vendor AVPs
Transport Directly over IP, protocol 115 (no UDP)
Devices Cisco IOS: R1 192.168.12.1, R2 192.168.12.2, Ethernet pseudowire with VC ID 12
Wireshark filter l2tp or ip.proto == 115

Packets in this capture

No. Time      Source        Destination   Info
1   0.000000  192.168.12.1  192.168.12.2  SCCRQ   (ccid=0x00000000)
2   0.015709  192.168.12.2  192.168.12.1  StopCCN (ccid=0xA91B13DE)
3   0.018735  192.168.12.1  192.168.12.2  ZLB     (ccid=0xBA767EB6)
4   1.489805  192.168.12.2  192.168.12.1  SCCRQ   (ccid=0x00000000)
5   1.507339  192.168.12.1  192.168.12.2  SCCRP   (ccid=0xAFA10E53)
6   1.516107  192.168.12.2  192.168.12.1  SCCCN   (ccid=0xC8EF90B9)
7   1.521495  192.168.12.1  192.168.12.2  ZLB     (ccid=0xAFA10E53)
8   1.537639  192.168.12.2  192.168.12.1  ICRQ    (ccid=0xC8EF90B9)
9   1.556687  192.168.12.1  192.168.12.2  ICRP    (ccid=0xAFA10E53)
10  1.570856  192.168.12.2  192.168.12.1  ICCN    (ccid=0xC8EF90B9)
11  1.574877  192.168.12.2  192.168.12.1  SLI     (ccid=0xC8EF90B9)
12  1.577266  192.168.12.1  192.168.12.2  ZLB     (ccid=0xAFA10E53)
13  1.581710  192.168.12.1  192.168.12.2  SLI     (ccid=0xAFA10E53)
14  1.587463  192.168.12.2  192.168.12.1  ZLB     (ccid=0xC8EF90B9)
15  1.590932  192.168.12.1  192.168.12.2  ZLB     (ccid=0xAFA10E53)

Packet walkthrough

Start-Control-Connection-Request (packet 1)

R1 opens the conversation with an SCCRQ:

Layer 2 Tunneling Protocol version 3
    Session ID: 0x00000000
    Flags: 0xc803, Type: Control Message, Length Bit, Sequence Bit
        1... .... .... .... = Type: Control Message (1)
        .1.. .... .... .... = Length Bit: Length field is present
    Control Connection ID: 0x00000000
    Ns: 0
    Nr: 0
    Control Message AVP
        AVP Type: Control Message (0)
        Message Type: Start_Control_Request (1)
    Protocol Version AVP
        Version: 1
        Revision: 0
    Framing Capabilities AVP
    Tie Breaker AVP
        Tie Breaker: 0xdba24dff9af979f8
    Firmware Revision AVP
        Firmware Revision: 4400 (0x1130)
    Host Name AVP
        Host Name: R1
    Vendor Name AVP
        Vendor Name: Cisco Systems, Inc.
    Receive Window Size AVP
        Receive Window Size: 1024
    Vendor ciscoSystems (9): Assigned Connection ID AVP
        Assigned Control Connection ID: 2837124062
    Vendor ciscoSystems (9): Pseudowire Capabilities List AVP
        Pseudowire Capabilities List
            PW Type: Ethernet (5)
            PW Type: Ethernet VLAN (4)
            PW Type: HDLC (6)
            PW Type: PPP (7)
            PW Type: Frame Relay DLCI (1)
            PW Type: ATM Cell transparent Port Mode (3)
            PW Type: ATM Cell transport VPC Mode (10)
            PW Type: ATM Cell transport VCC Mode (9)
            PW Type: IP Transport (11)
    Vendor ciscoSystems (9): Draft AVP Version AVP
        Draft AVP Version: 1
  • IP protocol 115: L2TPv3 can run directly over IP, without UDP. The Session ID field comes first: 0 means “this is a control message”. Data packets carry the remote router’s session ID here instead.
  • Control Connection ID 0: R1 doesn’t know R2’s ID for this connection yet, so it sends 0.
  • Assigned Control Connection ID 2837124062: R1’s own ID for this control connection. R2 must put this value in every control message it sends back to R1. Each router picks its own ID, so the two directions use different values.
  • Ns and Nr: the control channel is reliable without TCP. Ns is the sequence number of this message, and Nr is the next message the sender expects to receive. A receiver that has nothing to say acknowledges with a ZLB (Zero-Length Body) message, a control header without AVPs.
  • Tie Breaker: a random 64-bit value. If both routers send an SCCRQ at the same time, they compare tie breakers, and the lowest value wins.
  • Receive Window Size 1024: how many unacknowledged control messages R1 accepts.
  • Pseudowire Capabilities: the circuit types R1 can carry. This lab uses an Ethernet pseudowire (type 5).

Collision: StopCCN (packet 2)

Layer 2 Tunneling Protocol version 3
    Session ID: 0x00000000
    Control Connection ID: 0xa91b13de
    Ns: 0
    Nr: 1
    Control Message AVP
        Message Type: Stop_Control_Notification (4)
    Result-Error Code AVP
        Result code: Control connection already exists (3)
        Error code: No General Error (0)
        Error Message: Peer CC tie break loser

R2 was also trying to bring up a control connection to R1. It compared the tie breakers, and R1’s request lost. R2 rejects it with a StopCCN, result code 3 (“control connection already exists”), and the message “Peer CC tie break loser”. R1 acknowledges with a ZLB in packet 3, and the control connection R2 starts in packet 4 is the one that comes up. This collision is normal when both ends have an xconnect and come up together. It looks a lot like the connection collision in BGP.

Control connection: SCCRQ, SCCRP, SCCCN (packets 4-7)

The control connection uses a three-way handshake:

  • SCCRQ (packet 4): R2 requests the control connection, with its own assigned control connection ID 0xAFA10E53.
  • SCCRP (packet 5): R1 replies. Its Control Connection ID field is 0xAFA10E53 (R2’s ID), and it assigns its own ID, 3371143353 (0xC8EF90B9).
  • SCCCN (packet 6): R2 confirms, using ccid 0xC8EF90B9 (R1’s ID). R1 acknowledges with a ZLB in packet 7.

Follow the ccid values in the packet list: everything R2 sends carries 0xC8EF90B9, and everything R1 sends carries 0xAFA10E53. Each router puts the receiver’s ID in the header.

Session: ICRQ, ICRP, ICCN (packets 8-10)

With the control connection up, R2 sets up a session for the Ethernet circuit:

Layer 2 Tunneling Protocol version 3
    Session ID: 0x00000000
    Control Connection ID: 0xc8ef90b9
    Ns: 2
    Nr: 1
    Control Message AVP
        Message Type: Incoming_Call_Request (10)
    Call Serial Number AVP
        Call Serial Number: 255000002
    Vendor ciscoSystems (9): Local Session ID AVP
        Local Session ID: 4248977899
    Vendor ciscoSystems (9): Remote Session ID AVP
        Remote Session ID: 0
    Vendor ciscoSystems (9): Remote End ID AVP
        Remote End ID: 12
    Vendor ciscoSystems (9): Pseudowire Type AVP
        Pseudowire Type: Ethernet (5)
    Vendor ciscoSystems (9): Session Tie Breaker AVP
        Tie Breaker: 0x61628c38403950b3
    Vendor ciscoSystems (9): Interface MTU AVP
        Interface MTU: 1500
  • ICRQ: “I want to set up a session for this circuit.”
  • Remote End ID 12: the VC ID from xconnect 192.168.12.1 12 .... Both routers must use the same VC ID, or the session doesn’t come up.
  • Local Session ID 4248977899: R2’s session ID. R1 will put this value in the Session ID field of every data packet it sends to R2. Remote Session ID 0: R2 doesn’t know R1’s session ID yet.
  • Pseudowire Type Ethernet and Interface MTU 1500: both ends must agree on the circuit type, and on Cisco also on the MTU.

In the ICRP (packet 9), R1 answers with its own Local Session ID, 4187694636, and echoes R2’s as the remote one. The ICCN (packet 10) confirms the session. Packets 11 and 13 are Set-Link-Info messages in which both routers report Circuit Status: Up for their attachment circuit. From then on, the routers forward Ethernet frames over IP protocol 115, each data packet carrying the other router’s session ID.

Ask a question or start a discussion by visiting our Community Forum