MSDP Source-Active Packet Capture

This packet capture contains a single MSDP Source-Active (SA) message. MSDP connects the RPs of different PIM domains. When a source starts sending to a group, its RP tells its MSDP peers: “there’s an active source for this group in my domain”. The SA message is that announcement, and it’s tiny: an RP address and a list of (S,G) pairs.

MSDP runs over a normal TCP session between the RPs, much like BGP. The MSDP SA filtering lesson shows how to control which SA messages are accepted. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

Packet walkthrough

The Source-Active message (packet 1)

Internet Protocol Version 4, Src: 2.2.2.2, Dst: 3.3.3.3
Transmission Control Protocol, Src Port: 35677, Dst Port: 639, Seq: 1, Ack: 1, Len: 20
Multicast Source Discovery Protocol
    Type: IPv4 Source-Active (1)
    Length: 20
    Entry Count: 1
    RP Address: 2.2.2.2
    (S,G) block: 192.168.12.1/32 -> 239.1.1.1
        Sprefix len: 32
        Group Address: 239.1.1.1
        Source Address: 192.168.12.1

Here’s what this packet tells us:

• TCP 639: MSDP peers use a TCP session between their configured addresses, here the loopbacks 2.2.2.2 and 3.3.3.3.
• Type 1: IPv4 Source-Active. Other MSDP message types are keepalive (4) and the rarely used SA Request and SA Response.
• Entry Count 1: one SA message can list many (S,G) pairs for the same RP. This one has a single entry.
• RP Address 2.2.2.2: the RP in the source’s domain. Receivers’ RPs use it for the peer-RPF check, to accept the SA only from the right MSDP peer.
• (S,G) 192.168.12.1, 239.1.1.1: an active source and the group it sends to. An RP with receivers for 239.1.1.1 can now join the source tree toward 192.168.12.1.
• Sprefix len 32: always 32 for IPv4. The source is a host address.
• An SA can also carry the source’s first multicast packet (encapsulated data), so receivers in other domains get it right away. This one doesn’t, which is why it’s only 20 bytes of MSDP data.