Lesson Contents
This packet capture shows how a Cisco switch announces its VLAN database with VTP (VLAN Trunking Protocol) version 2. A VTP server sends two advertisement types after a change: a summary advertisement with the domain name and configuration revision number, followed by a subset advertisement with the actual VLAN list. The configuration revision number decides whether other switches overwrite their VLAN database, so it’s worth seeing on the wire.
The introduction to VTP lesson explains server, client and transparent mode, and VTP version 3 shows how the newer version protects against accidental overwrites and adds extended-range VLANs. More captures are in the Packet Capture Library.
Want to open this capture in Wireshark yourself? The pcap file is free with a NetworkLessons account. Your free account also unlocks all our free lessons and every capture in the Packet Capture Library.
Create a free account to download the pcap
Already have an account? Log in and the download button appears here.
Capture overview
| File | vtp-v2-advertisement.pcapng |
| Packets | 2 (summary advertisement, subset advertisement) |
| Protocol | VTP version 2 (Cisco proprietary) |
| Encapsulation | IEEE 802.3, LLC/SNAP with OUI 00:00:0c and PID 0x2003, destination 01:00:0c:cc:cc:cc |
| Devices | Cisco Catalyst switch, VTP domain TEST |
| Wireshark filter | vtp |
Packets in this capture
No. Source Destination Length Info
1 Cisco_72:03:b0 CDP/VTP/DTP/PAgP/UDLD 102 Summary Advertisement, Revision: 23, Followers: 1
2 Cisco_72:03:b0 CDP/VTP/DTP/PAgP/UDLD 286 Subset Advertisement, Revision: 23, Seq: 1Packet walkthrough
Encapsulation
IEEE 802.3 Ethernet
Destination: CDP/VTP/DTP/PAgP/UDLD (01:00:0c:cc:cc:cc)
Source: Cisco_72:03:b0 (00:08:32:72:03:b0)
Length: 88
Logical-Link Control
DSAP: SNAP (0xaa)
SSAP: SNAP (0xaa)
Control field: U, func=UI (0x03)
Organization Code: 00:00:0c (Cisco Systems, Inc)
PID: VTP (0x2003)VTP uses the same Cisco multicast MAC address as CDP, DTP, PAgP and UDLD. The SNAP Protocol ID tells them apart: 0x2003 is VTP (CDP is 0x2000, DTP is 0x2004). VTP is only sent on trunk links. These frames are untagged, so they were sent on the native VLAN of the trunk.
Summary advertisement (packet 1)
VLAN Trunking Protocol
Version: 0x02
Code: Summary Advertisement (0x01)
Followers: 1
Management Domain Length: 4
Management Domain: TEST
Configuration Revision Number: 23
Updater Identity: 0.0.0.0
Update Timestamp: 21-02-23 13:05:07
MD5 Digest: 67f205d9c55f4d780452cc6d2ac9dd6d- Code 0x01: Summary advertisement. VTP servers and clients send one every 5 minutes, and right after every change to the VLAN database. Code 0x02 is a subset advertisement, and code 0x03 is an advertisement request: a switch asks for the VLAN database, for example after it reboots or sees a higher revision.
- Followers: 1: the number of subset advertisements that follow this summary. A periodic summary without changes has 0 followers. This one announces a change, so one subset follows.
- Management Domain: TEST: switches ignore advertisements from other VTP domains. The domain name is case-sensitive.
- Configuration Revision Number: 23: the switch increments it with every VLAN change. A switch that receives a higher revision in the same domain (and with the same password) replaces its whole VLAN database with the advertised one. That’s why connecting a switch with a higher revision number can wipe VLANs across the domain.
- Updater Identity: 0.0.0.0: the IP address of the switch that made the last change. 0.0.0.0 means the switch had no IP address it could use when the change was made.
- Update Timestamp: when the last change was made, in YY-MM-DD HH:MM:SS format, based on the switch clock.
- MD5 Digest: a hash of the VTP password (if any) and the VLAN configuration. Switches with a different password calculate a different digest and report an MD5 digest error instead of accepting the update.
Subset advertisement (packet 2)
VLAN Trunking Protocol
Version: 0x02
Code: Subset Advertisement (0x02)
Sequence Number: 1
Management Domain Length: 4
Management Domain: TEST
Configuration Revision Number: 23
VLAN Information
VLAN Information Length: 20
Status: 0x00
.... ...0 = VLAN suspended: False
VLAN Type: Ethernet (0x01)
VLAN Name Length: 7
ISL VLAN ID: 0x0001
MTU Size: 1500
802.10 Index: 0x000186a1
VLAN Name: default
VLAN Information
VLAN Information Length: 20
Status: 0x00
.... ...0 = VLAN suspended: False
VLAN Type: Ethernet (0x01)
VLAN Name Length: 8
ISL VLAN ID: 0x000a
MTU Size: 1500
802.10 Index: 0x000186aa
VLAN Name: DESKTOPS
VLAN Information
VLAN Information Length: 20
Status: 0x00
.... ...0 = VLAN suspended: False
VLAN Type: Ethernet (0x01)
VLAN Name Length: 7
ISL VLAN ID: 0x0014
MTU Size: 1500
802.10 Index: 0x000186b4
VLAN Name: SERVERS
VLAN Information
VLAN Information Length: 24
Status: 0x00
.... ...0 = VLAN suspended: False
VLAN Type: Ethernet (0x01)
VLAN Name Length: 10
ISL VLAN ID: 0x001e
MTU Size: 1500
802.10 Index: 0x000186be
VLAN Name: MANAGEMENT
VLAN Information
VLAN Information Length: 24
VLAN Type: FDDI (0x02)
ISL VLAN ID: 0x03ea
MTU Size: 1500
VLAN Name: fddi-default
VLAN Information
VLAN Information Length: 48
VLAN Type: TrCRF (0x03)
ISL VLAN ID: 0x03eb
MTU Size: 4472
VLAN Name: trcrf-default
VLAN Information
VLAN Information Length: 32
VLAN Type: FDDI-net (0x04)
ISL VLAN ID: 0x03ec
MTU Size: 4472
VLAN Name: fddinet-default
VLAN Information
VLAN Information Length: 36
VLAN Type: TrBRF (0x05)
ISL VLAN ID: 0x03ed
MTU Size: 4472
VLAN Name: trbrf-defaultI shortened the last four entries. In the pcap they also contain Token Ring parameters such as ring and bridge numbers.
- Sequence Number 1: the first (and here the only) subset. A large VLAN database is split over several subset advertisements with increasing sequence numbers.
- One VLAN Information entry per VLAN: VLAN 1 (default), 10 (DESKTOPS), 20 (SERVERS) and 30 (MANAGEMENT). The ID field is called “ISL VLAN ID” for historical reasons. It’s simply the VLAN number, in hex: 0x000a is 10, 0x0014 is 20, 0x001e is 30.
- 802.10 Index: the SAID value, 100000 + VLAN ID by default. 0x000186a1 is 100001 for VLAN 1.
- VLANs 1002-1005: the legacy FDDI and Token Ring default VLANs. Every Cisco switch has them, so they’re always in the advertisement.
- VTP version 1 and 2 only advertise VLANs 1-1005. Extended-range VLANs (1006-4094) need VTP version 3.