Lesson Contents
This packet capture shows VRRP (Virtual Router Redundancy Protocol) version 2 on two Cisco routers that share the virtual IP address 192.168.1.3. In four packets you see a router become master, announce the virtual MAC address 00:00:5e:00:01:01 with gratuitous ARP, and then a router with a higher priority advertise itself and take over, because preemption is on by default in VRRP.
It’s a compact capture for learning the VRRP header and the difference between the virtual MAC and the real interface addresses. If VRRP doesn’t behave the way you expect, for example with two masters at the same time, see troubleshooting VRRP. More captures are in the Packet Capture Library.
Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.
Create a free account to download the pcap
Already have an account? Log in and the download button appears here.
Capture overview
| File | vrrp-gratuitous-arp.pcapng |
| Packets | 4 (2 VRRP advertisements, 2 gratuitous ARPs) |
| Protocol | VRRPv2 (RFC 3768), IP protocol 112 |
| Transport | IPv4 multicast 224.0.0.18, TTL 255 |
| Devices | Cisco IOS: R1 192.168.1.1 (priority 200), R2 192.168.1.2 (priority 100). Group 1, virtual IP 192.168.1.3 |
| Wireshark filter | vrrp || arp.isgratuitous |
Packets in this capture
No. Time Source Destination Info
1 0.000000 192.168.1.2 224.0.0.18 Announcement (v2), priority 100
2 0.023757 IETF-VRRP-VRID_01 Broadcast Gratuitous ARP for 192.168.1.3 (Reply)
3 0.026946 IETF-VRRP-VRID_01 STP-UplinkFast Gratuitous ARP for 192.168.1.3 (Reply)
4 0.034386 192.168.1.1 224.0.0.18 Announcement (v2), priority 200Packet walkthrough
VRRP advertisement from R2 (packet 1)
Ethernet II, Src: IETF-VRRP-VRID_01 (00:00:5e:00:01:01), Dst: IPv4mcast_12 (01:00:5e:00:00:12)
Internet Protocol Version 4, Src: 192.168.1.2, Dst: 224.0.0.18
0100 .... = Version: 4
.... 0101 = Header Length: 20 bytes (5)
Total Length: 40
Time to Live: 255
Protocol: VRRP (112)
Source Address: 192.168.1.2
Destination Address: 224.0.0.18
Virtual Router Redundancy Protocol
Version 2, Packet type 1 (Advertisement)
0010 .... = VRRP protocol version: 2
.... 0001 = VRRP packet type: Advertisement (1)
Virtual Rtr ID: 1
Priority: 100 (Default priority for a backup VRRP router)
Addr Count: 1
Auth Type: No Authentication (0)
Adver Int: 1
Checksum: 0xb950 [correct]
IP Address: 192.168.1.3- Only the master sends advertisements. Backup routers stay silent and just listen. When R2 sends this advertisement, it’s acting as master for group 1.
- Source MAC 00:00:5e:00:01:01: the master sends advertisements from the virtual MAC, not its own interface MAC. The format is 00:00:5e:00:01:VRID, so group 1 gets …:01. Switches learn the virtual MAC on the port of the current master. The IP source is still the router’s real address, 192.168.1.2.
- 224.0.0.18, IP protocol 112, TTL 255: VRRP runs directly on IP, not on UDP. Receivers must drop VRRP packets with a TTL other than 255. That guarantees the packet came from the local link. Compare this with HSRP, which uses UDP 1985 to 224.0.0.2 (v1) or 224.0.0.102 (v2).
- Virtual Rtr ID 1: the VRRP group number (1-255).
- Priority 100: the default. The highest priority becomes master. 255 is reserved for the IP address owner, a router whose real interface address is the virtual IP. Priority 0 means “I’m resigning as master”.
- Adver Int 1: one advertisement per second. If a backup doesn’t hear the master for about 3 seconds (3 × the interval plus a small skew time based on its priority), it takes over.
- Auth Type 0: no authentication. RFC 3768 removed the authentication types from VRRPv2, and VRRPv3 has no authentication field at all. Cisco still supports plain-text and MD5 authentication for VRRPv2.
- IP Address 192.168.1.3: the virtual IP address the hosts use as their default gateway.
Gratuitous ARP (packets 2 and 3)
Ethernet II, Src: IETF-VRRP-VRID_01 (00:00:5e:00:01:01), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Address Resolution Protocol (reply/gratuitous ARP)
Hardware type: Ethernet (1)
Protocol type: IPv4 (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: reply (2)
Sender MAC address: IETF-VRRP-VRID_01 (00:00:5e:00:01:01)
Sender IP address: 192.168.1.3
Target MAC address: Broadcast (ff:ff:ff:ff:ff:ff)
Target IP address: 192.168.1.3- When a router becomes master, it sends a gratuitous ARP: an unsolicited ARP reply that says “192.168.1.3 is at 00:00:5e:00:01:01”. Sender IP and target IP are both the virtual IP. RFC 3768 specifies a gratuitous ARP request. Cisco IOS sends it as an unsolicited reply (opcode 2), as you can see here.
- Hosts already have this MAC in their ARP cache, because the virtual MAC never changes. The important receivers are the switches: the frame comes from the new master’s port, so every switch updates its MAC address table and sends traffic for the virtual MAC to the new master.
- Packet 3 is the same gratuitous ARP sent to 01:00:0c:cd:cd:cd, a Cisco multicast address that Wireshark labels “STP-UplinkFast”. Cisco IOS sends this extra copy. It’s a Cisco-specific detail, not part of the VRRP standard.
VRRP advertisement from R1 (packet 4)
Ethernet II, Src: IETF-VRRP-VRID_01 (00:00:5e:00:01:01), Dst: IPv4mcast_12 (01:00:5e:00:00:12)
Internet Protocol Version 4, Src: 192.168.1.1, Dst: 224.0.0.18
Time to Live: 255
Protocol: VRRP (112)
Virtual Router Redundancy Protocol
Version 2, Packet type 1 (Advertisement)
Virtual Rtr ID: 1
Priority: 200 (Non-default backup priority)
Addr Count: 1
Auth Type: No Authentication (0)
Adver Int: 1
Checksum: 0x5550 [correct]
IP Address: 192.168.1.334 milliseconds later, R1 also advertises for group 1, with priority 200. It uses the same virtual MAC as its source. When R2 receives an advertisement with a higher priority than its own, it goes back to the backup state and stops advertising. Preemption is enabled by default in VRRP, which is why R1 with the higher priority can take over the master role. HSRP has preemption disabled by default.