IS-IS LSP and PSNP Acknowledgment Packet Capture

Lesson Contents

This packet capture shows how IS-IS makes flooding reliable on a point-to-point link. R4 sends its Level 2 LSP, and 50 milliseconds later its neighbor answers with a PSNP (Partial Sequence Numbers PDU) that lists exactly that LSP. That PSNP is the acknowledgment: without it, R4 would keep retransmitting the LSP.

The PSNP doesn’t carry any routing information, only an LSP entry with four fields that identify one specific version of the LSP. The introduction to IS-IS lesson explains LSPs, CSNPs and PSNPs, and the IS-IS Point-to-Point Hello Packet Capture shows the adjacency on this kind of link. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

File	is-is-lsp-psnp-acknowledgment.pcapng
Packets	2
Protocol	IS-IS (ISO 10589), L2 LSP (PDU type 20) and L2 PSNP (PDU type 27)
Encapsulation	IEEE 802.3 with LLC, destination 01:80:c2:00:00:15 (AllL2ISs)
Devices	Cisco IOS routers R4 (0000.0000.0004) and R3 (0000.0000.0003), area 49.0001
Wireshark filter	`isis.psnp` or `isis`

Packets in this capture

No.  Time      Source             Destination          Protocol   Info
1    0.000000  aa:bb:cc:00:78:00  ISIS-all-level-2-IS  ISIS LSP   L2 LSP, LSP-ID: 0000.0000.0004.00-00, Sequence: 0x00000001, Lifetime: 1199s
2    0.050344  aa:bb:cc:00:76:10  ISIS-all-level-2-IS  ISIS PSNP  L2 PSNP, Source-ID: 0000.0000.0003.00

Packet walkthrough

The LSP (packet 1)

I cut the output after the first TLVs. The IP reachability TLVs that follow are in the pcap.

ISO 10589 ISIS Link State Protocol Data Unit
    PDU length: 86
    Remaining lifetime: 1199
    LSP-ID: 0000.0000.0004.00-00
    Sequence number: 0x00000001
    Checksum: 0x87bd [correct]
        .... .0.. = Overload bit: Not set
        .... ..11 = Type of Intermediate System: Level 2 (3)
    Area address(es) (t=1, l=4)
        Type: 1
        Length: 4
        Area address (3): 49.0001
    Protocols supported (t=129, l=1)
        Type: 129
        Length: 1
        NLPID: IP (0xcc)
            NLPID: 0xcc
    Hostname (t=137, l=2)
        Type: 137
        Length: 2
        Hostname: R4
    IS Reachability (t=2, l=12)
        Type: 2
        Length: 12
        Reserved: 0x00
        IS Neighbor: 0000.0000.0003.00
            ..00 1010 = Default Metric: 10
            .0.. .... = Default Metric: Internal
            IS Neighbor: 0000.0000.0003.00
    IP Interface address(es) (t=132, l=4)

Here’s what this packet tells us:

LSP-ID 0000.0000.0004.00-00: system ID, pseudonode ID (00, a real router) and fragment number (00).
Sequence number 0x00000001: the first version of this LSP. R4 just started IS-IS.
Remaining lifetime 1199: IS-IS counts down from 1200 seconds by default. Cisco refreshes the LSP before it reaches 0.
Checksum 0x87bd: covers the LSP contents, so a router can detect a corrupted copy.
Hostname TLV (137) and IS Reachability (TLV 2): R4 advertises its name and its neighbor 0000.0000.0003 with metric 10. TLV 2 is the old “narrow” metric format, which is why Wireshark also shows delay, expense and error metrics (I removed those lines).

The PSNP acknowledgment (packet 2)

ISO 10589 ISIS InTRA Domain Routeing Information Exchange Protocol
    Intradomain Routing Protocol Discriminator: ISIS (0x83)
    Length Indicator: 17
    Version/Protocol ID Extension: 1
    ID Length: 0
    000. .... = Reserved: 0x0
    ...1 1011 = PDU Type: L2 PSNP (27)
    Version: 1
    Reserved: 0
    Maximum Area Addresses: 0
ISO 10589 ISIS Partial Sequence Numbers Protocol Data Unit
    PDU length: 35
    Source-ID: 0000.0000.0003
    Source-ID-Circuit: 00
    LSP entries (t=9, l=16)
        Type: 9
        Length: 16
        LSP Entry
            LSP Sequence Number: 0x00000001
            Remaining Lifetime: 1198
            LSP checksum: 0x87bd
        LSP-ID: 0000.0000.0004.00-00

Let’s walk through the highlighted fields:

PDU type 27: L2 PSNP from R3 (source ID 0000.0000.0003).
One LSP entry with the LSP ID, sequence number 0x00000001 and checksum 0x87bd: exactly the version R4 just sent. That combination identifies the LSP, so it acknowledges this copy and no other.
Remaining lifetime 1198: one second less than in the LSP. R3 reports its own copy, which has aged since it arrived.
On a point-to-point link, every LSP is acknowledged like this. On a LAN, there are no per-LSP acknowledgments. Instead the DIS sends periodic CSNPs with a summary of all LSPs, and routers use PSNPs to request the LSPs they’re missing.