EIGRP and HSRP multicast traffic visible from hosts... need help as to why?

Unanswered Question
Apr 29th, 2007

Hey guys!

In a typical access/distribution layer setup, why it it that when I start ethereal/wireshark on a regular host, I see EIGRP and HSRP multicast traffic ( &

I thought this multicast traffic should only go between the two distribution layer switches, not all the way down to the access layer switch and to a host.

Anyone know why this is happening? Is it a configuration problem, or normal?

Funny thing too... in some sites I only see HSRP traffic, while in others I see HSRP and EIGRP traffic.

Thanks so much!

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4 (5 ratings)
tdistlists Sun, 04/29/2007 - 17:26


I thought the purpose of multicast was one-to-many.

If it behaves like this, its just like a broadcast.

The multicast traffic should just go to those "interested" yes? Shouldn't the switch via igmp snooping know that no hosts are interested in HSRP or EIGRP multicasts?

Any of our apps that use multicast seem to work fine... any host that isn't part of the group wont get the message.

Why are they all getting these?

Thanks again for the help.

Richard Burts Sun, 04/29/2007 - 17:44


I believe that the key to this is, as was already pointed out, that 224.0.0.x is a special set of addresses reserved for link local usage (which means is it sent on the local link to everyone but never forwarded off the local link). I do not believe that igmp snooping examines link local traffic.



scottmac Sun, 04/29/2007 - 19:16

Keep in mind that, as previously pointed out, that a multicast propagates like a broadcast.

The default mode for a switch is to propagate broadcasts and multicasts because, a switch operating in a basic mode is acting as a multiport bridge.

The "Multicast features" found in higher-end switches is there to RESTRICT multicasts, to prune them back to the ports that are participating in the group.

Without the "special features" enabled and properly configured, a multicast, like a broadcast, will be propagated to all ports in that VLAN (VLAN = Broadcast Domain).

Hope this helps

Good Luck


ankbhasi Sun, 04/29/2007 - 21:37

Hi Friend,

When it's a multicast ip traffic it will also have multicast mac address as a destination address which will not be known by any switch cam table so when it is received on switches and switches do not find those mac addresses in its cam table they will broadcast.

Now because it's a well known reserve multicast address IGMP snooping will also not work for these addresses so what you are observing is expected results.



*Pls rate all helpfull post

tdistlists Mon, 04/30/2007 - 05:29

Thank you everyone for the help.

So, for all intents and purposes, EIGRP/HSRP basically use a broadcast? If its flooded regardless, then thats the same behavior as a broadcast.

I have 6500s and 4500s behaving like this, so I thought that it would/should prune... I didn't fine-tune multicast much, just configured pim sparse-dense on the routers and igmp snooping on the L2-switches.

Perhaps CGMP can prune the multicasts... because in some parts of my network EIGRP doesn't reach the desktop, and in some parts it does. This leads me to believe I'm doing something wrong somewhere.

Also, the following link implies that only router ports should get the HSRP packets with CGMP:


Thanks again for all the assistance.

Richard Burts Mon, 04/30/2007 - 05:49


Actually for all intents and purposes EIGRP/HSRP multicast are significantly different from broadcasts. For a frame with a broadcast destination MAC address every end station must receive the frame and pass it up the stack to see if it is something that should be processed. With multicast destination MAC address the end station will only receive the frame and pass it up the stack if it is a multicast that the NIC has been told is interesting and should be processed. You are seeing them when you run wireshark/ethereal because that instructs the NIC to run in promiscuous mode and receive and process everything. For most of the end stations on the network they will not receive or process the EIGRP or HSRP multicast frames.



tdistlists Mon, 04/30/2007 - 06:51

Ahh, I see. Okay, that makes sense... I really appreciate the explanation!

What continues to get me is this quote from that link "HSRP Hello DOES NOT flow down this link".

We have a similar topology, two L3-switches with a port channel in between, and each has a downlink to the access switch. Seems as if somehow (config wise) I can not send this traffic to the access layer -- by means other than passive interface (for EIGRP) for that vlan.



This Discussion