07-19-2007 09:58 AM - edited 03-05-2019 05:23 PM
Hi Guys,
I have the standard core/dist/access setup in a campus environment.
Distribution had two 6500s with MSFCs running vlan x. Vlan X has EIGRP, HSRP and PIM enabled. Down on my access switch I run up ethereal, and I see PIM, and HSRP packets.
Can someone please remind me of the following:
Why do I see HSRP and PIM packets as they are not addressed to ff:ff:ff:ff:ff:ff and are to their respective MAC addresses and why if I see HSRP and PIM hellos, do I not see EIGRP hellos?
Im a tad confused this evening :)
Hope everyone is well,
Cheers,
Ken
Solved! Go to Solution.
07-19-2007 10:26 AM
Hi Ken,
PIM,HSRP,EIGRP all use reserve multicast address and because their multicast ip address translate to multicast mac address which is not learned in switch cam table, switch treats frame destined to those multicast address in broadcast fasion and is the reason you can see those frames received on your downstream switch in ether real.
Also you cannot snoop reserved multicast addresses.
HTH
Ankur
*Pls rate all helpfull post
07-19-2007 01:22 PM
Ken
The answer given by Ankur helps explain why you ARE seeing PIM and HSRP but not why you are NOT seeing EIGRP hellos messages. My first guess is that either EIGRP is not enabled on that interface or that interface is made passive and the chief characteristic of passive EIGRP interfaces is that it does not send hello messages. Can you confirm whether the interface matches a network statement in EIGRP and if so whether it is made passive? A good first step is to do show ip eigrp interface and look to see if the interface is listed.
HTH
Rick
07-22-2007 08:30 PM
Ken
There is a simple explanation of why the CAM does not show any multicast MAC addresses. As you are aware the CAM is built by looking at the source MAC address on frames that enter the switch. If you think about it briefly it may become obvious that the multicast MAC is always the destination MAC address but never the source MAC address (the source MAC represents the interface from which it came and the source interface is always a single device).
HTH
Rick
07-19-2007 10:26 AM
Hi Ken,
PIM,HSRP,EIGRP all use reserve multicast address and because their multicast ip address translate to multicast mac address which is not learned in switch cam table, switch treats frame destined to those multicast address in broadcast fasion and is the reason you can see those frames received on your downstream switch in ether real.
Also you cannot snoop reserved multicast addresses.
HTH
Ankur
*Pls rate all helpfull post
07-19-2007 01:22 PM
Ken
The answer given by Ankur helps explain why you ARE seeing PIM and HSRP but not why you are NOT seeing EIGRP hellos messages. My first guess is that either EIGRP is not enabled on that interface or that interface is made passive and the chief characteristic of passive EIGRP interfaces is that it does not send hello messages. Can you confirm whether the interface matches a network statement in EIGRP and if so whether it is made passive? A good first step is to do show ip eigrp interface and look to see if the interface is listed.
HTH
Rick
07-19-2007 11:17 PM
Yes you are correct. It was a very long day yesterday and did not even think about passive.
Many thx Rick. U solved it :))
07-19-2007 11:23 PM
Ankur,
Many many thx. That is great. Really helpful.
So what does the switch do differently to ensure that a range of multicast addresses do not get entered into the cam table? And is there a doc on it? Is it just hard coded in costos software/hardware?
Say there was two routers on a switch, I would have assumed I would see (if I do a show cam dyn) a physical address and 2 multicast mac? (for HSRP and PIM)
I then did a show cam 01:00:5e:00:00:02
and a show cam 01:00:5e:00:00:0d and it does not appear anywhere? Even in a system cam entry?
So that explains why you are correct.
Many thx to all,
Regards,
Ken
07-22-2007 08:30 PM
Ken
There is a simple explanation of why the CAM does not show any multicast MAC addresses. As you are aware the CAM is built by looking at the source MAC address on frames that enter the switch. If you think about it briefly it may become obvious that the multicast MAC is always the destination MAC address but never the source MAC address (the source MAC represents the interface from which it came and the source interface is always a single device).
HTH
Rick
07-22-2007 11:24 PM
Mate,
Spot on. Thankyou very much!!!!
Cheers
Ken
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide