RIPv2 Request and Response Packet Capture

This packet capture contains a RIPv2 request and the response to it. A Cisco router that just enabled RIP doesn’t want to wait up to 30 seconds for the next periodic update, so it asks its neighbors for their whole routing table. The request has one special entry that means “send me everything”.

The RIP lessons RIP distance vector routing protocol and how to configure RIP cover the protocol and configuration. The TTL of 2 in the request is explained in TTL 2 in EIGRP and RIP packets. More captures are in the Packet Capture Library.

Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.

Create a free account to download the pcap

Already have an account? Log in and the download button appears here.

Capture overview

File	rip-v2-request-response.pcapng
Packets	2
Protocol	RIPv2 (RFC 2453)
Transport	UDP 520 → 520; request to 224.0.0.9, response unicast
Devices	Cisco IOS routers 192.168.12.1 (asks) and 192.168.12.2 (answers)
Wireshark filter	rip

Packets in this capture

No.  Time      Source        Destination   Protocol  Info
1    0.000000  192.168.12.1  224.0.0.9     RIPv2     Request
2    0.000372  192.168.12.2  192.168.12.1  RIPv2     Response

Packet walkthrough

Request (packet 1)

Internet Protocol Version 4, Src: 192.168.12.1, Dst: 224.0.0.9
User Datagram Protocol, Src Port: 520, Dst Port: 520
Routing Information Protocol
    Command: Request (1)
    Version: RIPv2 (2)
    Address not specified, Metric: 16
        Address Family: Unspecified (0)
        Route Tag: 0
        Netmask: 0.0.0.0
        Next Hop: 0.0.0.0
        Metric: 16

There are a few things worth pointing out:

• 224.0.0.9, UDP 520: RIPv2 uses the multicast address 224.0.0.9 for all RIP routers. RIPv1 used broadcasts.
• Command 1: Request.
• One entry with address family 0 and metric 16: this exact combination means “send me your entire routing table”. A request can also list specific prefixes, but a router that just started RIP uses this form.

Response (packet 2)

Internet Protocol Version 4, Src: 192.168.12.2, Dst: 192.168.12.1
User Datagram Protocol, Src Port: 520, Dst Port: 520
Routing Information Protocol
    Command: Response (2)
    Version: RIPv2 (2)
    IP Address: 2.2.2.2, Metric: 1
        Address Family: IP (2)
        Route Tag: 0
        IP Address: 2.2.2.2
        Netmask: 255.255.255.255
        Next Hop: 0.0.0.0
        Metric: 1

This is what the fields in red mean:

• Unicast to 192.168.12.1: the answer goes straight back to the router that asked, 0.4 milliseconds later. Periodic updates go to 224.0.0.9 instead.
• Command 2: Response: requested responses and periodic updates use the same command.
• 2.2.2.2/32, metric 1: R2’s loopback. RIPv2 carries the netmask, which RIPv1 didn’t, so it supports classless routing. Metric 1 means one hop. 16 would mean unreachable.
• Next Hop 0.0.0.0: “send traffic for this prefix to me”, the router that sent the response.
• Route Tag 0: a field for marking redistributed routes. It’s not used here.
• Address Family 2: IP. Authentication entries use the special family 0xFFFF in the first entry, as in the RIPv2 MD5 Authentication Packet Capture.