vrrp is 36% of packets captured by Wireshark

Unanswered Question

After experiencing a sluggish network today, I ran Wireshark on my PC at work for an hour and found 37% of all packets were vrrp advertisements to multicast address Should my PC be getting these multicast packets? Advertisement interval is the default 1 second. Also found that there are 5 secondaries on this vlan and all six networks are sending a vrrp advertisement every second. Apart from the fact that six networks on one vlan isn't a best practice design, is it normal to get vrrp advertisements on a host pc? Thought these advertisements were just to the other vrrp routers.

Thanks. AK

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Jon Marshall Mon, 07/13/2009 - 14:09
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN


Couple of things.

Firstly any multicast address will be broadcasted within the vlan if you have not set up multicast within your network.

Having said that even if multicast was enabled there are certain multicast addresses that are always flooded within the ethernet segment ie. the vlan. These are the reserved multicast addresses of which is one.

So in answer to the question yes it is normal, although obviously your PC does not nothing with these packets.



This Discussion