IS-IS Point-to-Point Hello Packet Capture

This packet capture contains an IS-IS point-to-point hello, sent on an Ethernet link that is configured with isis network point-to-point. On a point-to-point circuit there’s no DIS and no separate Level 1 and Level 2 hellos: one PDU type (17) does it all, and a special TLV tracks the three-way handshake with the neighbor.

Compare it with the IS-IS Level 1 LAN Hello Packet Capture to see what’s different on a broadcast link. The introduction to IS-IS lesson covers levels and adjacencies. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

Packet walkthrough

The point-to-point hello (packet 1)

IEEE 802.3 Ethernet
    Destination: DEC-MAP-(or-OSI?)-Intermediate-System-Hello? (09:00:2b:00:00:05)
    Source: aa:bb:cc:00:76:10 (aa:bb:cc:00:76:10)
    Length: 1499
Logical-Link Control
    Control field: U, func=UI (0x03)
ISO 10589 ISIS InTRA Domain Routeing Information Exchange Protocol
    Intradomain Routing Protocol Discriminator: ISIS (0x83)
    Length Indicator: 20
    Version/Protocol ID Extension: 1
    ID Length: 0
    000. .... = Reserved: 0x0
    ...1 0001 = PDU Type: P2P HELLO (17)
    Version: 1
    Reserved: 0
    Maximum Area Addresses: 0
ISIS HELLO
    .... ..10 = Circuit type: Level 2 only (0x2)
    0000 00.. = Reserved: 0x00
    SystemID {Sender of PDU}: 0000.0000.0003
    Holding timer: 30
    PDU length: 1496
    Local circuit ID: 2
    Restart Signaling (t=211, l=3)
        Type: 211
        Length: 3
    Point-to-point Adjacency State (t=240, l=15)
        Type: 240
        Length: 15
        Adjacency State: Up (0)
        Extended Local circuit ID: 0x00000002
        Neighbor SystemID: 0000.0000.0004
        Neighbor Extended Local circuit ID: 0x00000001
    Protocols Supported (t=129, l=1)
        Type: 129
        Length: 1
        NLPID: IP (0xcc)
    Area address(es) (t=1, l=4)
        Type: 1
        Area address (3): 49.0001
    IP Interface address(es) (t=132, l=4)
        Type: 132
        IPv4 interface address: 192.168.34.3
    Padding (t=8, l=255)
        Type: 8
        Length: 255
    Padding (t=8, l=255)
        Type: 8
        Length: 255
    Padding (t=8, l=255)
        Type: 8
        Length: 255
    Padding (t=8, l=255)
        Type: 8
        Length: 255
    Padding (t=8, l=255)
        Type: 8
        Length: 255
    Padding (t=8, l=146)
        Type: 8
        Length: 146

Let’s walk through the highlighted fields:

• Destination 09:00:2b:00:00:05: on a point-to-point circuit, Cisco sends hellos to this MAC address (AllISs), not to the Level 1 and Level 2 LAN addresses 01:80:c2:00:00:14 and 01:80:c2:00:00:15.
• PDU type 17: P2P HELLO: one hello type for both levels. The circuit type (here Level 2 only) says which levels this router wants on the link.
• No priority and no DIS field: a point-to-point link has no DIS election, so those fields from the LAN hello are gone. In their place is a local circuit ID.
• Point-to-point Adjacency State TLV (240): the three-way handshake. The router reports its view of the adjacency, Up, together with the neighbor’s system ID (0000.0000.0004) and the neighbor’s circuit ID. A router only moves to Up when it sees its own system ID reflected in the neighbor’s hello.
• Area address 49.0001: for a Level 2 adjacency, the area doesn’t have to match.
• Padding: like LAN hellos, Cisco pads point-to-point hellos to the full MTU (Ethernet length 1499), so an MTU mismatch prevents the adjacency.