MPLS LDP Hello Packet Capture

This packet capture contains a single MPLS LDP Hello message from a Cisco IOS router. LDP routers multicast these hellos to 224.0.0.2 on UDP 646, on every LDP-enabled interface, to discover their neighbors. Before two routers can exchange labels, they have to find each other this way.

The hello is small, but it carries the two fields behind a lot of LDP troubleshooting: the LSR ID that identifies the router, and the transport address the neighbor has to reach to build the TCP session. What happens after the hellos is in the MPLS LDP Session and Label Mapping Packet Capture, and you’ll find more captures like these in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

Packet walkthrough

Here is the packet:

Internet Protocol Version 4, Src: 192.168.12.1, Dst: 224.0.0.2
    Time to Live: 1
User Datagram Protocol, Src Port: 646, Dst Port: 646
Label Distribution Protocol
    Version: 1
    PDU Length: 30
    LSR ID: 192.168.12.1
    Label Space ID: 0
    Hello Message
        0... .... = U bit: Unknown bit not set
        Message Type: Hello Message (0x100)
        Message Length: 20
        Message ID: 0x00000000
        Common Hello Parameters
            00.. .... = TLV Unknown bits: Known TLV, do not Forward (0x0)
            TLV Type: Common Hello Parameters (0x400)
            TLV Length: 4
            Hold Time: 15
            0... .... .... .... = Targeted Hello: Link Hello
            .0.. .... .... .... = Hello Requested: Source does not request periodic hellos
            ..0. .... .... .... = GTSM Flag: Not set
            ...0 0000 0000 0000 = Reserved: 0x0000
        IPv4 Transport Address
            00.. .... = TLV Unknown bits: Known TLV, do not Forward (0x0)
            TLV Type: IPv4 Transport Address (0x401)
            TLV Length: 4
            IPv4 Transport Address: 192.168.12.1

Let’s walk through the interesting fields:

• Destination 224.0.0.2, UDP 646, TTL 1: link hellos are multicast to “all routers on this subnet” with a TTL of 1, so they never leave the link. Only the hellos use UDP. The LDP session itself runs over TCP 646.
• LSR ID: the first four bytes of the LDP identifier. It identifies the router, similar to a router ID in OSPF or BGP. Cisco IOS picks the highest loopback address unless you set it with mpls ldp router-id. Here the LSR ID is the interface address 192.168.12.1.
• Label Space ID 0: the last two bytes of the LDP identifier (192.168.12.1:0). Zero means a platform-wide label space, which is what you see on almost every router: one label table for all interfaces.
• Hold Time 15: the hold time this router proposes for the hello adjacency. If no new hello arrives within the hold time, the adjacency is dropped. Cisco sends link hellos every 5 seconds with a 15-second hold time. Both routers use the lower of the two proposed values.
• Targeted Hello: Link Hello: this is a basic discovery hello for a directly connected neighbor. Targeted hellos are unicast to a remote LSR. You see them for LDP session protection and for pseudowires such as AToM/VPLS.
• IPv4 Transport Address: the address this router uses for the TCP session. The neighbor must have a route to it, or the TCP session never comes up. If this TLV is missing, the neighbor uses the source IP address of the hello instead. By default, Cisco IOS advertises the LSR ID as the transport address.