I have the standard core/dist/access setup in a campus environment.
Distribution had two 6500s with MSFCs running vlan x. Vlan X has EIGRP, HSRP and PIM enabled. Down on my access switch I run up ethereal, and I see PIM, and HSRP packets.
Can someone please remind me of the following:
Why do I see HSRP and PIM packets as they are not addressed to ff:ff:ff:ff:ff:ff and are to their respective MAC addresses and why if I see HSRP and PIM hellos, do I not see EIGRP hellos?
Im a tad confused this evening :)
Hope everyone is well,
There is a simple explanation of why the CAM does not show any multicast MAC addresses. As you are aware the CAM is built by looking at the source MAC address on frames that enter the switch. If you think about it briefly it may become obvious that the multicast MAC is always the destination MAC address but never the source MAC address (the source MAC represents the interface from which it came and the source interface is always a single device).
The answer given by Ankur helps explain why you ARE seeing PIM and HSRP but not why you are NOT seeing EIGRP hellos messages. My first guess is that either EIGRP is not enabled on that interface or that interface is made passive and the chief characteristic of passive EIGRP interfaces is that it does not send hello messages. Can you confirm whether the interface matches a network statement in EIGRP and if so whether it is made passive? A good first step is to do show ip eigrp interface and look to see if the interface is listed.
PIM,HSRP,EIGRP all use reserve multicast address and because their multicast ip address translate to multicast mac address which is not learned in switch cam table, switch treats frame destined to those multicast address in broadcast fasion and is the reason you can see those frames received on your downstream switch in ether real.
Also you cannot snoop reserved multicast addresses.
*Pls rate all helpfull post