vrrp is 36% of packets captured by Wireshark

akrauska · ‎07-13-2009

After experiencing a sluggish network today, I ran Wireshark on my PC at work for an hour and found 37% of all packets were vrrp advertisements to multicast address 224.0.0.18. Should my PC be getting these multicast packets? Advertisement interval is the default 1 second. Also found that there are 5 secondaries on this vlan and all six networks are sending a vrrp advertisement every second. Apart from the fact that six networks on one vlan isn't a best practice design, is it normal to get vrrp advertisements on a host pc? Thought these advertisements were just to the other vrrp routers.

Thanks. AK

Jon Marshall · ‎07-13-2009

AK

Couple of things.

Firstly any multicast address will be broadcasted within the vlan if you have not set up multicast within your network.

Having said that even if multicast was enabled there are certain multicast addresses that are always flooded within the ethernet segment ie. the vlan. These are the reserved multicast addresses of which 224.0.0.18 is one.

So in answer to the question yes it is normal, although obviously your PC does not nothing with these packets.

Jon