GLBP Hello Packet Capture

This packet capture contains a single GLBP (Gateway Load Balancing Protocol) hello from a Cisco router. GLBP is Cisco’s first hop redundancy protocol that also load-balances, and one hello carries both of its roles: the router’s state as AVG (active virtual gateway) and its state as AVF (active virtual forwarder), each in its own TLV.

Wireshark’s GLBP dissector is reverse-engineered, which is why some field names end in a question mark. The GLBP lesson explains AVGs, AVFs and load balancing, and the GLBP ARP Reply with Virtual MAC Packet Capture shows how hosts get a forwarder’s MAC. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

Packet walkthrough

The GLBP hello (packet 1)

Ethernet II, Src: Cisco_00:01:01 (00:07:b4:00:01:01), Dst: IPv4mcast_66 (01:00:5e:00:00:66)
Internet Protocol Version 4, Src: 192.168.12.1, Dst: 224.0.0.102
User Datagram Protocol, Src Port: 3222, Dst Port: 3222
Gateway Load Balancing Protocol
    Version?: 1
    Unknown1: 0
    Unknown2: 0000
    Owner ID: aa:bb:cc:00:89:00 (aa:bb:cc:00:89:00)
    TLV l=28, t=Hello
        Type: Hello (1)
        Length: 28
        Unknown1-0: 00
        VG state?: Active (32)
        Unknown1-1: 00
        Priority: 150
        Unknown1-2: 0000
        Helloint: 3000
        Holdint: 10000
        Redirect: 600
        Timeout: 14400
        Unknown1-3: 0000
        Address type: IPv4 (1)
        Address length: 4
        Virtual IPv4: 192.168.12.254
    TLV l=20, t=Request/Response?
        Type: Request/Response? (2)
        Length: 20
        Forwarder?: 1
        VF state?: Active (32)
        Unknown2-1: 00
        Priority: 167
        Weight: 100
        Unknown2-2: 00384002580000
        Virtualmac: Cisco_00:01:01 (00:07:b4:00:01:01)

This is what the fields in red mean:

• UDP 3222 to 224.0.0.102: GLBP uses its own port, but the same multicast address as HSRPv2.
• Source MAC 0007.b400.0101: the router sends its hellos from its virtual forwarder MAC. The format is 0007.b4 followed by the group number and the forwarder number, so this is group 1, forwarder 1.
• Owner ID aa:bb:cc:00:89:00: the router’s real MAC address, which identifies the sender.
• Hello TLV, VG state Active: this router is the AVG for the group. Priority 150 is higher than the default of 100, which is why it won the election.
• Helloint 3000, Holdint 10000: hello and hold time in milliseconds, the defaults of 3 and 10 seconds.
• Redirect 600, Timeout 14400: the redirect and secondary hold timers in seconds. They control how long a failed forwarder’s MAC keeps being used.
• Virtual IPv4 192.168.12.254: the default gateway address the hosts use.
• Second TLV, forwarder 1, VF state Active: this router is also the AVF for forwarder 1, with its own priority and weight 100. The weight decides how much of the load this forwarder gets.
• Virtualmac 0007.b400.0101: the MAC address this forwarder answers for.