BFD Control Packet Capture

This packet capture contains a single BFD (Bidirectional Forwarding Detection) control packet from a Cisco router whose BFD session is Up. BFD is a lightweight hello protocol: routers exchange these small packets at a regular (slightly jittered) rate, and when a few in a row go missing, BFD tells OSPF, EIGRP, BGP or HSRP that the neighbor is gone. That’s much faster than waiting for the routing protocol’s own hold timer.

The whole packet is 24 bytes of BFD data, and every field matters for how fast a failure is detected. The BFD lesson shows the configuration and a failover, and HSRP BFD peering shows BFD with a first hop redundancy protocol. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

Packet walkthrough

Internet Protocol Version 4, Src: 192.168.12.1, Dst: 192.168.12.2
    Total Length: 52
    Time to Live: 255
    Protocol: UDP (17)
User Datagram Protocol, Src Port: 49152, Dst Port: 3784
    Length: 32
BFD Control message
    001. .... = Protocol Version: 1
    ...0 0000 = Diagnostic Code: No Diagnostic (0x00)
    11.. .... = Session State: Up (0x3)
    Message Flags: 0xc0
        0... .. = Poll: Not set
        .0.. .. = Final: Not set
        ..0. .. = Control Plane Independent: Not set
        ...0 .. = Authentication Present: Not set
        .... 0. = Demand: Not set
        .... .0 = Multipoint: Not set
    Detect Time Multiplier: 3 (= 3000 ms Detection time)
    Message Length: 24 bytes
    My Discriminator: 0x00000001
    Your Discriminator: 0x00000001
    Desired Min TX Interval: 1000 ms (1000000 us)
    Required Min RX Interval: 1000 ms (1000000 us)
    Required Min Echo Interval:   50 ms (50000 us)

IP and UDP

• Unicast to the neighbor: BFD control packets go directly to the neighbor’s interface address. There’s no multicast discovery: a routing protocol (here OSPF) tells BFD which neighbor to monitor.
• UDP destination port 3784: single-hop BFD control packets. Multihop BFD (for example between eBGP neighbors on loopbacks) uses port 4784, and BFD echo packets use port 3785.
• Source port 49152: RFC 5881 requires a source port from 49152 to 65535.
• TTL 255: single-hop BFD must be sent with TTL 255, and receivers drop packets with a lower TTL. That’s the same trick VRRP and GTSM use: a packet with TTL 255 can only come from a directly connected router.

BFD header

• Session State: Up: a BFD session goes through Down, Init and Up. Each router puts its own view of the session in this field. When both sides report Up, failure detection is active.
• Diagnostic Code 0: no problem. When a session goes down, the router uses this field to say why, for example 1 (Control Detection Time Expired) or 3 (Neighbor Signaled Session Down). That’s very useful when you capture during a failure.
• Discriminators: every session gets a unique ID on each router. My Discriminator is the sender’s own ID, and Your Discriminator is the ID the sender learned from its neighbor. Both are 1 here, because each router only has one BFD session. During session setup, Your Discriminator is 0, because the router hasn’t heard from its neighbor yet.
• Desired Min TX Interval 1000 ms: how often this router wants to send BFD packets.
• Required Min RX Interval 1000 ms: the fastest rate at which this router can receive them. The actual transmit interval is the higher of the local TX value and the neighbor’s RX value. Neither router can push the other faster than it accepts.
• Detect Time Multiplier 3: the neighbor declares the session down after 3 missed intervals, so after 3 × 1000 ms = 3 seconds. With a typical production setting of 50 ms × 3, detection drops to 150 ms.
• Required Min Echo Interval 50 ms: this router is willing to loop back its neighbor’s BFD echo packets, at most one every 50 ms. In echo mode, a router sends packets that its neighbor loops back through the forwarding plane, so they test the data path without involving the neighbor’s CPU. A value of 0 would mean it doesn’t support receiving echo packets.
• Poll and Final flags: used when a router wants to change its timers. It sends packets with the Poll bit until the neighbor answers with the Final bit. Both are clear here, because this is a steady-state session.
• Authentication Present: not set: BFD supports simple password, MD5 and SHA1 authentication. When it’s enabled, an authentication section follows the 24-byte header.

These timers come from bfd interval 1000 min_rx 1000 multiplier 3, a slow setting that’s easy to follow in a lab capture. You’ll typically use much lower values in production.