RIPng Response Packet Capture

This packet capture contains a RIPng response, the IPv6 version of RIP. It looks a lot like RIPv2, with a few telling differences: a different UDP port, an IPv6 multicast address, a prefix length instead of a netmask, and no next hop field at all.

The RIPng on Cisco IOS lesson covers the configuration. To compare it with IPv4, see the RIPv2 Request and Response Packet Capture. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

Packet walkthrough

The RIPng response (packet 1)

Internet Protocol Version 6, Src: fe80::a8bb:ccff:fe00:7100, Dst: ff02::9
User Datagram Protocol, Src Port: 521, Dst Port: 521
RIPng
    Command: Response (2)
    Version: 1
    Reserved: 0000
    Route Table Entry: IPv6 Prefix: 2001:db8::1/128 Metric: 1
        IPv6 Prefix: 2001:db8::1
        Route Tag: 0x0000
        Prefix Length: 128
        Metric: 1
    Route Table Entry: IPv6 Prefix: 2001:db8:12::/64 Metric: 1
        IPv6 Prefix: 2001:db8:12::
        Route Tag: 0x0000
        Prefix Length: 64
        Metric: 1

Let’s look at the important fields:

• UDP port 521: RIPng has its own port. RIPv1 and RIPv2 use 520.
• To ff02::9 from a link-local address: ff02::9 is the all-RIP-routers multicast address. RIPng updates always come from the router’s link-local address, and that address is the next hop for the routes in the update.
• Version 1: RIPng has its own version numbering. Version 1 is the only one.
• Route table entries: each entry is 20 bytes: a 16-byte IPv6 prefix, a 2-byte route tag, a 1-byte prefix length and a 1-byte metric.
• No next hop field: RIPv2 has one per route. RIPng only has a special next hop entry (metric 0xFF) that you can put before a group of routes. Without it, the next hop is the sender’s link-local address, as here.
• 2001:db8::1/128 and 2001:db8:12::/64, metric 1: a loopback and a connected network. Like in RIPv2, metric 16 means unreachable.