RIPv2 MD5 Authentication Packet Capture

This packet capture contains a RIPv2 response with MD5 authentication. RIPv2 has no separate header for authentication. Instead, it sacrifices the first route entry: that slot, marked with a special address family, holds the key ID, a sequence number and a pointer to where the MD5 digest is, at the very end of the packet.

The route itself (1.1.1.1/32) is still readable: MD5 authentication proves who sent it, but doesn’t hide anything. The RIP lesson covers the protocol, and the RIPv2 Request and Response Packet Capture shows the same packets without authentication. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

Packet walkthrough

The authenticated response (packet 1)

User Datagram Protocol, Src Port: 520, Dst Port: 520
Routing Information Protocol
    Command: Response (2)
    Version: RIPv2 (2)
    Authentication: Keyed Message Digest
        Authentication type: Keyed Message Digest (3)
        Digest Offset: 44
        Key ID: 1
        Auth Data Len: 20
        Seq num: 1
        Authentication Data Trailer
            Authentication Data: dfe92f9c2871ccc65d4836b190e1f587
    IP Address: 1.1.1.1, Metric: 1
        Address Family: IP (2)
        Route Tag: 0
        IP Address: 1.1.1.1
        Netmask: 255.255.255.255
        Next Hop: 0.0.0.0
        Metric: 1

Here’s what this packet tells us:

• The first entry is the authentication entry: it has address family 0xFFFF instead of 2 (IP). A router that doesn’t do authentication ignores it, because it’s not a route.
• Authentication type 3: Keyed Message Digest. Type 2 would be a plain-text password, visible in the packet.
• Digest Offset 44: where the digest starts. 4 bytes of RIP header, 20 bytes of authentication entry and 20 bytes for one route entry: 44.
• Key ID 1: the key number from the key chain. Both routers need the same key number with the same key string.
• Auth Data Len 20: the length of the trailer that holds the digest.
• Seq num 1: a sequence number for replay protection. RFC 2082 says a receiver should reject packets with a lower sequence number than the last one it accepted from this sender.
• The route entry, 1.1.1.1/32 with metric 1: unchanged and unencrypted.
• Authentication Data Trailer: the 16-byte MD5 digest, calculated over the whole RIP packet and the shared key. The receiver calculates the same digest and drops the packet if they don’t match.