IS-IS Level 1 LAN Hello (IIH) Packet Capture

Lesson Contents

This packet capture contains a single IS-IS Level 1 LAN Hello, also called an IIH (IS-IS Hello). IS-IS routers send hellos to discover neighbors, elect the DIS and check that they share an area. On the wire, IS-IS looks very different from OSPF or EIGRP: there’s no IP header at all, and the frame is a full 1514 bytes even though the hello only carries a few fields. That padding is IS-IS’s built-in MTU check.

The introduction to IS-IS lesson covers levels, areas and NETs. The DIS field in this hello is explained in IS-IS DIS and pseudonode, and IS-IS authentication shows the TLV you’d see in a hello with authentication. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

File	is-is-l1-hello-packet.pcapng
Packets	1
Protocol	IS-IS (ISO 10589, RFC 1195), PDU type 15: L1 LAN Hello
Encapsulation	IEEE 802.3 with LLC (DSAP/SSAP 0xFE), destination 01:80:c2:00:00:14
Devices	Cisco IOS router, system ID 0000.0000.0001
Wireshark filter	`isis.hello` or `isis`

Packet walkthrough

Encapsulation

Frame 1: 1514 bytes on wire (12112 bits), 1514 bytes captured (12112 bits)
IEEE 802.3 Ethernet
    Destination: ISIS-all-level-1-IS (01:80:c2:00:00:14)
    Source: fa:16:3e:55:47:10 (fa:16:3e:55:47:10)
    Length: 1500
Logical-Link Control
    DSAP: ISO Network Layer (0xfe)
    SSAP: ISO Network Layer (0xfe)
    Control field: U, func=UI (0x03)

IEEE 802.3 with a Length field instead of an EtherType: IS-IS is an OSI protocol that runs directly on layer 2. An LLC header with DSAP/SSAP 0xFE (ISO Network Layer) identifies it. That’s also why IS-IS can’t be routed and doesn’t care about IP addressing for adjacencies.
01:80:c2:00:00:14 (AllL1ISs): the multicast MAC for Level 1 routers. Level 2 hellos go to 01:80:c2:00:00:15 (AllL2ISs).

IS-IS header and hello fields

ISO 10589 ISIS InTRA Domain Routeing Information Exchange Protocol
    Intradomain Routing Protocol Discriminator: ISIS (0x83)
    Length Indicator: 27
    Version/Protocol ID Extension: 1
    ID Length: 0
    000. .... = Reserved: 0x0
    ...0 1111 = PDU Type: L1 HELLO (15)
    Version: 1
    Reserved: 0
    Maximum Area Addresses: 0
ISIS HELLO
    .... ..01 = Circuit type: Level 1 only (0x1)
    0000 00.. = Reserved: 0x00
    SystemID {Sender of PDU}: 0000.0000.0001
    Holding timer: 30
    PDU length: 1497
    .100 0000 = Priority: 64
    0... .... = Reserved: 0
    SystemID {Designated IS}: 0000.0000.0001.01

PDU Type 15: Level 1 LAN hello. Type 16 is a Level 2 LAN hello, and type 17 is the point-to-point hello used on point-to-point links for both levels.
ID Length 0 and Maximum Area Addresses 0: zero means “use the default”, a 6-byte system ID and 3 area addresses.
Circuit type: Level 1 only: this interface only forms L1 adjacencies. A level-1-2 router on a LAN sends separate L1 and L2 hellos.
System ID 0000.0000.0001: the router’s unique ID, taken from its NET. IS-IS uses the system ID, not an IP address, to identify routers.
Holding timer 30: the neighbor drops the adjacency if it doesn’t hear a hello within 30 seconds. Cisco’s default is a 10-second hello interval with a multiplier of 3.
Priority 64: the default DIS priority on Cisco. The router with the highest priority becomes the DIS on the LAN. The highest SNPA (MAC address) breaks a tie. Unlike in OSPF, a router with priority 0 can still become the DIS.
Designated IS 0000.0000.0001.01: the LAN ID, the DIS system ID plus a pseudonode ID (01). This router currently lists itself as the DIS. You’ll see this when a router is alone on the segment, or before it has heard a better candidate.

TLVs

    Protocols Supported (t=129, l=1)
        NLPID: IP (0xcc)
    Area address(es) (t=1, l=4)
        Area address (3): 49.0012
    IP Interface address(es) (t=132, l=4)
        IPv4 interface address: 192.168.12.1
    Restart Signaling (t=211, l=3)
        Restart Signaling Flags: 0x00
    Padding (t=8, l=255)
    Padding (t=8, l=255)
    Padding (t=8, l=255)
    Padding (t=8, l=255)
    Padding (t=8, l=255)
    Padding (t=8, l=163)

Protocols Supported, NLPID 0xCC: this router routes IPv4 (integrated IS-IS, RFC 1195). An IPv6-enabled router would also list NLPID 0x8E.
Area address 49.0012: Level 1 neighbors must share at least one area address, or they won’t form an adjacency. Level 2 doesn’t have that requirement.
IP interface address: the IPv4 address of the interface. Neighbors use it as the next hop for routes learned through this router.
No IS Neighbors TLV (type 6): this hello doesn’t list any neighbor MAC addresses yet. Once the router hears the neighbor, the hello includes the neighbor’s MAC in TLV 6. That’s how IS-IS does the “I see you” part of the three-way handshake on a LAN.
Padding TLVs (type 8): the router pads the hello up to the interface MTU, which is why the frame is 1514 bytes. If a neighbor’s interface has a smaller MTU, the padded hello is dropped and no adjacency forms. This is IS-IS’s built-in MTU mismatch check. Cisco IOS lets you disable it with no isis hello padding.