PIM Bidir DF Election Packet Capture

This packet capture shows a DF election in bidirectional PIM. In PIM bidir, every link elects one designated forwarder (DF) per RP: the router with the best path to the RP, which forwards multicast traffic toward the RP and down to receivers. The election uses its own PIM message type with four subtypes. Two of them are in this capture: an Offer and a Winner.

Each message carries the RP address and the sender’s route preference and metric to that RP. The bidirectional PIM lesson explains shared trees and why bidir needs a DF. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

File	multicast-pim-bidir-df-election-offer-winner.pcapng
Packets	2
Protocol	PIM-SM bidirectional (RFC 5015), DF election (type 10)
Transport	IP protocol 103, to 224.0.0.13 (ALL-PIM-ROUTERS), TTL 1
Devices	Cisco IOS routers 192.168.12.1 and 192.168.12.2, RP 1.1.1.1
Wireshark filter	pim.type == 10

Packets in this capture

No.  Time      Source        Destination  Protocol  Info
1    0.000000  192.168.12.2  224.0.0.13   PIMv2     DF election
2    0.001011  192.168.12.1  224.0.0.13   PIMv2     DF election

Packet walkthrough

Offer from 192.168.12.2 (packet 1)

Internet Protocol Version 4, Src: 192.168.12.2, Dst: 224.0.0.13
Protocol Independent Multicast
    0010 .... = Version: 2
    .... 1010 = Type: DF election (10)
    0001 .... = DF Subtype: offer (1)
    .... 0000 = DF reserved: 0
    Checksum: 0xd2ed [correct]
    PIM Options
        RP: 1.1.1.1
            Address Family: IPv4 (1)
            Encoding Type: Native (0)
            Unicast: 1.1.1.1
        DF Metric Preference: 4294967295
        Metric: 4294967295

Let’s walk through the highlighted fields:

• PIM type 10: DF election, sent to 224.0.0.13 with TTL 1, like all PIM link messages.
• Subtype 1: Offer: “I could be the DF for this RP, and this is my route to it”. The other subtypes are Winner (2), Backoff (3) and Pass (4).
• RP 1.1.1.1: a DF is elected per RP, so every message names the RP it’s about.
• Metric preference and metric 4294967295: the maximum value, the worst offer possible. The router with the lowest preference, then the lowest metric, wins. In effect, 192.168.12.2 isn’t competing for the DF role.

Winner from 192.168.12.1 (packet 2)

Internet Protocol Version 4, Src: 192.168.12.1, Dst: 224.0.0.13
Protocol Independent Multicast
    0010 .... = Version: 2
    .... 1010 = Type: DF election (10)
    0010 .... = DF Subtype: DF Winner (2)
    .... 0000 = DF reserved: 0
    Checksum: 0xd2dd [correct]
    PIM Options
        RP: 1.1.1.1
            Address Family: IPv4 (1)
            Encoding Type: Native (0)
            Unicast: 1.1.1.1
        DF Metric Preference: 0
        Metric: 0

There are a few things worth pointing out:

• Subtype 2: Winner, one millisecond later. 192.168.12.1 announces that it’s the DF for RP 1.1.1.1 on this link.
• Preference 0 and metric 0: the best possible values. A metric of 0 to the RP usually means the RP address is on the router itself.
• From now on, only 192.168.12.1 forwards traffic for groups mapped to 1.1.1.1 on this link. The election repeats when the path to the RP changes.