LISP Map-Register and Map-Notify Packet Capture

This packet capture shows how a LISP site tells the mapping system where it is. The ETR (192.168.123.1) sends a Map-Register to the map server (192.168.123.3): “EID prefix 192.168.1.0/24 can be reached through my RLOC 192.168.123.1”. Because it asks for confirmation, the map server answers with a Map-Notify.

Both messages carry the same mapping record and a shared-key authentication field, so a map server only accepts registrations from sites it knows. The LISP lesson explains EIDs, RLOCs, map servers and map resolvers. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

File	lisp-map-register-map-notify.pcapng
Packets	2
Protocol	LISP control plane (RFC 9301), Map-Register (type 3) and Map-Notify (type 4)
Transport	UDP 4342 → 4342
Devices	Cisco IOS routers: ETR 192.168.123.1, map server 192.168.123.3
Wireshark filter	lisp

Packets in this capture

No.  Time      Source         Destination    Protocol  Info
1    0.000000  192.168.123.1  192.168.123.3  LISP      Map-Register for 192.168.1.0/24
2    0.072138  192.168.123.3  192.168.123.1  LISP      Map-Notify for 192.168.1.0/24

Packet walkthrough

Map-Register (packet 1)

User Datagram Protocol, Src Port: 4342, Dst Port: 4342
Locator/ID Separation Protocol
    0011 .... .... .... .... .... = Type: Map-Register (3)
    .... ..1. .... .... .... .... = I bit (xTR-ID present): Set
    .... .... .... .... .... ...1 = M bit (Want-Map-Notify): Set
    Record Count: 1
    Nonce: 0xa3c38d652ce9f3a0
    Key ID: 0x0001
    Authentication Data Length: 20
    Authentication Data: abd011106d5ce510e9fdbe3c3dc038b5547999d0
    Mapping Record 1, EID Prefix: 192.168.1.0/24, TTL: 1440, Action: No-Action, Authoritative
        Record TTL: 1440
        Locator Count: 1
        EID Mask Length: 24
        000. .... .... .... = Action: No-Action (0)
        ...1 .... .... .... = Authoritative bit: Set
        EID Prefix AFI: IPv4 (1)
        EID Prefix: 192.168.1.0
        Locator Record 1, Local RLOC: 192.168.123.1, Reachable, Priority/Weight: 10/10, Multicast Priority/Weight: 10/10
            Priority: 10
            Weight: 10
            Flags: 0x0005
                .... .... .... .1.. = Local: Set
                .... .... .... ...1 = Reachable: Set
            AFI: IPv4 (1)
            Locator: 192.168.123.1
    xTR-ID: 92fcc41ad927b53289b7c29bbc04e06e
    Site-ID: 0000000000000000

This is what the fields in red mean:

• UDP 4342: the LISP control plane port. Encapsulated data traffic uses 4341.
• Type 3: Map-Register, from the ETR to the map server. ETRs send it periodically (every minute on Cisco) to keep the registration alive.
• M bit (Want-Map-Notify) set: the ETR asks the map server to confirm the registration. That’s why packet 2 exists.
• Nonce: a random 64-bit value. The Map-Notify must echo it, so the ETR can match the reply to its request.
• Key ID 1 and 20 bytes of authentication data: a hash over the message with the key shared between the site and the map server. The key itself is never sent.
• EID prefix 192.168.1.0/24, record TTL 1440: the site’s address space and how long (in minutes, so 24 hours) a mapping may be cached.
• Authoritative bit set: the ETR is the authority for this prefix.
• Locator record: RLOC 192.168.123.1, priority 10, weight 10: where traffic for the EID prefix should be tunneled. With several RLOCs, the lowest priority is used and the weight splits traffic between RLOCs with equal priority. The Local bit says this RLOC is the ETR’s own address.
• xTR-ID: present because the I bit is set. It identifies this tunnel router, even if its RLOC changes.

Map-Notify (packet 2)

I only kept the fields that differ from the Map-Register or that tie the two together.

Locator/ID Separation Protocol
    0100 .... .... .... .... .... = Type: Map-Notify (4)
    Nonce: 0xa3c38d652ce9f3a0
    Key ID: 0x0001
    Authentication Data Length: 20
    Authentication Data: dfdc0809af33df434f9a6e2000cf913bba9a8e7b
    Mapping Record 1, EID Prefix: 192.168.1.0/24, TTL: 1440, Action: No-Action, Not Authoritative
        ...0 .... .... .... = Authoritative bit: Not set
        Locator Record 1, RLOC: 192.168.123.1, Reachable, Priority/Weight: 10/10, Multicast Priority/Weight: 10/10
                .... .... .... .0.. = Local: Not set

Here’s what stands out:

• Type 4: Map-Notify, 72 milliseconds after the register.
• The same nonce, 0xa3c38d652ce9f3a0: this is the confirmation for that Map-Register.
• Its own authentication data, calculated by the map server with the same shared key, so the ETR knows the reply is genuine.
• The same mapping record, now with the Authoritative bit not set and the Local bit cleared: the map server repeats the registration as it stored it.