GLBP ARP Reply with Virtual MAC Packet Capture

This packet capture shows how GLBP load-balances without the hosts knowing it. A host (192.168.12.100) ARPs for its default gateway, the GLBP virtual IP 192.168.12.254. The AVG answers, and the MAC address in its ARP reply is a virtual forwarder MAC. The AVG hands out different forwarder MACs to different hosts, and that’s all the load balancing there is.

Two packets, and one detail that surprises people: the Ethernet source of the reply and the MAC address inside it are different. The GLBP lesson explains AVG and AVF roles, and the GLBP Hello Packet Capture shows where those roles are announced. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

Packets in this capture

No.  Time      Source             Destination        Protocol  Info
1    0.000000  aa:bb:cc:00:8c:00  Broadcast          ARP       Who has 192.168.12.254? Tell 192.168.12.100
2    0.000623  aa:bb:cc:00:89:00  aa:bb:cc:00:8c:00  ARP       192.168.12.254 is at 00:07:b4:00:01:01

Packet walkthrough

ARP request (packet 1)

The host broadcasts “who has 192.168.12.254?”. Both GLBP routers receive it, but only the AVG answers.

ARP reply (packet 2)

Ethernet II, Src: aa:bb:cc:00:89:00 (aa:bb:cc:00:89:00), Dst: aa:bb:cc:00:8c:00 (aa:bb:cc:00:8c:00)
    Destination: aa:bb:cc:00:8c:00 (aa:bb:cc:00:8c:00)
    Source: aa:bb:cc:00:89:00 (aa:bb:cc:00:89:00)
    Type: ARP (0x0806)
Address Resolution Protocol (reply)
    Hardware type: Ethernet (1)
    Protocol type: IPv4 (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: reply (2)
    Sender MAC address: Cisco_00:01:01 (00:07:b4:00:01:01)
    Sender IP address: 192.168.12.254
    Target MAC address: aa:bb:cc:00:8c:00 (aa:bb:cc:00:8c:00)
    Target IP address: 192.168.12.100

Here’s what stands out:

• Ethernet source aa:bb:cc:00:89:00: the AVG sends the reply from its own, real MAC address.
• Sender MAC address 0007.b400.0101: but the answer inside the ARP reply is a virtual forwarder MAC, group 1 forwarder 1. The host stores 192.168.12.254 → 0007.b400.0101 in its ARP cache and sends all its off-subnet traffic to that MAC.
• Sender IP address 192.168.12.254: the virtual IP the host asked for.
• Unicast to the host: like any ARP reply, it goes only to the host that asked.
• Another host that ARPs for the same IP can get a different forwarder MAC, for example 0007.b400.0102 for the second router. With the default round-robin load balancing, the AVG rotates through its forwarders with every ARP request.