LACP PDU Packet Capture

This packet capture contains one LACP (Link Aggregation Control Protocol) PDU from a Cisco switch whose EtherChannel is up. One frame carries everything LACP knows about the link: who the switch is (actor), who it’s talking to (partner), and a byte of state flags for each side.

Those state flags are what you check when a port won’t bundle. The EtherChannel lesson explains LACP active and passive mode, and troubleshooting EtherChannel covers what goes wrong. For Cisco’s own protocol, see the PAgP Packet Capture. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

Packet walkthrough

The LACP PDU (packet 1)

Ethernet II, Src: aa:bb:cc:00:67:10 (aa:bb:cc:00:67:10), Dst: Slow-Protocols (01:80:c2:00:00:02)
    Destination: Slow-Protocols (01:80:c2:00:00:02)
    Source: aa:bb:cc:00:67:10 (aa:bb:cc:00:67:10)
    Type: Slow Protocols (0x8809)
802.3 Slow protocols
    Slow Protocols subtype: LACP (0x01)
Link Aggregation Control Protocol
    LACP Version: 0x01
    TLV Type: Actor Information (0x01)
    TLV Length: 0x14
    Actor System Priority: 32768
    Actor System ID: aa:bb:cc:80:67:00 (aa:bb:cc:80:67:00)
    Actor Key: 1
    Actor Port Priority: 32768
    Actor Port: 2
    Actor State: 0x3d, LACP Activity, Aggregation, Synchronization, Collecting, Distributing
        .... ...1 = LACP Activity: Active
        .... ..0. = LACP Timeout: Long Timeout
        .... .1.. = Aggregation: Aggregatable
        .... 1... = Synchronization: In Sync
        ...1 .... = Collecting: Enabled
        ..1. .... = Distributing: Enabled
        .0.. .... = Defaulted: No
        0... .... = Expired: No
    Reserved: 000000
    TLV Type: Partner Information (0x02)
    TLV Length: 0x14
    Partner System Priority: 32768
    Partner System: aa:bb:cc:80:68:00 (aa:bb:cc:80:68:00)
    Partner Key: 1
    Partner Port Priority: 32768
    Partner Port: 2
    Partner State: 0x3c, Aggregation, Synchronization, Collecting, Distributing
        .... ...0 = LACP Activity: Passive
        .... ..0. = LACP Timeout: Long Timeout
        .... .1.. = Aggregation: Aggregatable
        .... 1... = Synchronization: In Sync
        ...1 .... = Collecting: Enabled
        ..1. .... = Distributing: Enabled
        .0.. .... = Defaulted: No
        0... .... = Expired: No
    Reserved: 000000
    TLV Type: Collector Information (0x03)
    TLV Length: 0x10
    Collector Max Delay: 32768
    Reserved: 000000000000000000000000
    TLV Type: Terminator (0x00)

This is what the fields in red mean:

• 01:80:c2:00:00:02 and EtherType 0x8809: the “slow protocols” multicast address, which switches never forward. LACP frames only travel one hop, from port to directly connected port.
• Actor System ID aa:bb:cc:80:67:00, priority 32768: the sending switch. Priority plus MAC form the system ID. The switch with the lowest system ID decides which ports are active when there are more ports than can be bundled.
• Actor Key 1: on Cisco, the key is the channel-group number. Ports only bundle with ports that have the same key.
• Actor Port 2, priority 32768: this physical port’s identity inside the bundle.
• Actor State 0x3d: LACP Activity Active (mode active), Long Timeout (a PDU every 30 seconds), Aggregatable, In Sync, Collecting and Distributing enabled. Those last three mean the port is fully part of the channel and forwarding traffic.
• Partner State 0x3c: the same flags, except LACP Activity is Passive. The other switch runs mode passive. Active with passive works, two passive ports never start a channel.
• Defaulted: No, Expired: No: the switch has real, current information from its partner. Defaulted set would mean it hasn’t heard any LACPDUs from the other side.