Solved: Multicast Flooding in Switches. - HSRP, PIM and EIGRP

kfarrington · ‎07-19-2007

Hi Guys,

I have the standard core/dist/access setup in a campus environment.

Distribution had two 6500s with MSFCs running vlan x. Vlan X has EIGRP, HSRP and PIM enabled. Down on my access switch I run up ethereal, and I see PIM, and HSRP packets.

Can someone please remind me of the following:

Why do I see HSRP and PIM packets as they are not addressed to ff:ff:ff:ff:ff:ff and are to their respective MAC addresses and why if I see HSRP and PIM hellos, do I not see EIGRP hellos?

Im a tad confused this evening :)

Hope everyone is well,

Cheers,

Ken

ankbhasi · ‎07-19-2007

Hi Ken,

PIM,HSRP,EIGRP all use reserve multicast address and because their multicast ip address translate to multicast mac address which is not learned in switch cam table, switch treats frame destined to those multicast address in broadcast fasion and is the reason you can see those frames received on your downstream switch in ether real.

Also you cannot snoop reserved multicast addresses.

HTH

Ankur

*Pls rate all helpfull post

View solution in original post

Richard Burts · ‎07-19-2007

Ken

The answer given by Ankur helps explain why you ARE seeing PIM and HSRP but not why you are NOT seeing EIGRP hellos messages. My first guess is that either EIGRP is not enabled on that interface or that interface is made passive and the chief characteristic of passive EIGRP interfaces is that it does not send hello messages. Can you confirm whether the interface matches a network statement in EIGRP and if so whether it is made passive? A good first step is to do show ip eigrp interface and look to see if the interface is listed.

HTH

Rick

HTH

Rick

View solution in original post

Richard Burts · ‎07-22-2007

Ken

There is a simple explanation of why the CAM does not show any multicast MAC addresses. As you are aware the CAM is built by looking at the source MAC address on frames that enter the switch. If you think about it briefly it may become obvious that the multicast MAC is always the destination MAC address but never the source MAC address (the source MAC represents the interface from which it came and the source interface is always a single device).

HTH

Rick

HTH

Rick

View solution in original post

ankbhasi · ‎07-19-2007

Hi Ken,

PIM,HSRP,EIGRP all use reserve multicast address and because their multicast ip address translate to multicast mac address which is not learned in switch cam table, switch treats frame destined to those multicast address in broadcast fasion and is the reason you can see those frames received on your downstream switch in ether real.

Also you cannot snoop reserved multicast addresses.

HTH

Ankur

*Pls rate all helpfull post

Richard Burts · ‎07-19-2007

Ken

The answer given by Ankur helps explain why you ARE seeing PIM and HSRP but not why you are NOT seeing EIGRP hellos messages. My first guess is that either EIGRP is not enabled on that interface or that interface is made passive and the chief characteristic of passive EIGRP interfaces is that it does not send hello messages. Can you confirm whether the interface matches a network statement in EIGRP and if so whether it is made passive? A good first step is to do show ip eigrp interface and look to see if the interface is listed.

HTH

Rick

HTH

Rick

kfarrington · ‎07-19-2007

Yes you are correct. It was a very long day yesterday and did not even think about passive.

Many thx Rick. U solved it :))

kfarrington · ‎07-19-2007

Ankur,

Many many thx. That is great. Really helpful.

So what does the switch do differently to ensure that a range of multicast addresses do not get entered into the cam table? And is there a doc on it? Is it just hard coded in costos software/hardware?

Say there was two routers on a switch, I would have assumed I would see (if I do a show cam dyn) a physical address and 2 multicast mac? (for HSRP and PIM)

I then did a show cam 01:00:5e:00:00:02

and a show cam 01:00:5e:00:00:0d and it does not appear anywhere? Even in a system cam entry?

So that explains why you are correct.

Many thx to all,

Regards,

Ken

Richard Burts · ‎07-22-2007

Ken

There is a simple explanation of why the CAM does not show any multicast MAC addresses. As you are aware the CAM is built by looking at the source MAC address on frames that enter the switch. If you think about it briefly it may become obvious that the multicast MAC is always the destination MAC address but never the source MAC address (the source MAC represents the interface from which it came and the source interface is always a single device).

HTH

Rick

HTH

Rick

kfarrington · ‎07-22-2007

Mate,

Spot on. Thankyou very much!!!!

Cheers

Ken