What is "proto=89" in this IP packet debug output?

What is "proto=89" in this IP packet debug output?

IP: s=172.16.22.1 (FastEthernet0/0), d=224.0.0.5, len 72, rcvd 0, proto=89

Find more posts tagged with

SAVE $250 on Your CISCO Boot Camp — Use Code "EXAM26"

Exclusively for TechExams members for Infosec Boot Camps starting before April 30, 2026

View CISCO Boot Camps

Comments

networker050184

That would be OSPF.

Protocol Numbers

workfrom925

Thanks for that.

Not relating to my question, but I don't find a protocol number for RIP in your linked page. Is it that RIP just don't need a protocol number?

networker050184

RIP uses UDP so the packet will have a protocol number of 17.

busines4u

RIP does need a protocol number. It uses UDP port 520

FrankGuthrie

Are we not getting thing mixed?

All routing protocols use a Protocol number to tell the receiving device what kind of data can be found in the packet received. UDP is the transport method used, like EIGRP uses RTP (Layer 4). What OSPF uses, still not clear to me. RIP also uses Layer 4 transport protocol (UDP)

networker050184

The IP protocol number indicates what the protocol will be at the next layer. OSPF does not use a transport protocol so the IP protocol number indicates OSPF. RIP uses UDP so the protocol filed indicates a UDP header coming up next. This field's naming is a little easier to understand in IPv6 as it is called 'next header'.

FrankGuthrie

networker050184 wrote: »

The IP protocol number indicates what the protocol will be at the next layer. OSPF does not use a transport protocol so the IP protocol number indicates OSPF. RIP uses UDP so the protocol filed indicates a UDP header coming up next. This field's naming is a little easier to understand in IPv6 as it is called 'next header'.

Another lesson learned today. Thank you sir.

theodoxa

d=224.0.0.5

It would also be useful to know the common Multicast addresses.

Multicast address - Wikipedia, the free encyclopedia

224.0.0.5 All OSPF Routers
224.0.0.6 All OSPF Designated Routers
224.0.0.9 All RIPv2 Routers
224.0.0.10 All EIGRP Routers

As for the protocol numbers, they are a number assigned by IP to identify the Transport Layer Protocol to hand the segment (IP Packet with the IP Header Removed) off to. OSPF (89) and EIGRP (8

both handle the Transport Layer duties. EIGRP uses its own Transport Layer Protocol called RTP (Reliable Transport Protocol). RIP uses UDP, which means IP would hand off the segment to UDP. Once it reaches Layer 7 (Application Layer), it is handed off to RIP. BGP uses TCP and would follow the same process as RIP, except handing the segment off to TCP instead of UDP.

Layer 7
Layer 4
Layer 3
Layer 2
Layer 1

EIGRP
RTP - 88
IPv4, IPv6, IPX, or AppleTalk
Various
Various

OSPF
??? - 89
IPv4, IPv6, ???
Various
Various

RIP
UDP - 17
IPv4, IPv6, ???
Various
Various

BGP
TCP - 06
IPv4, IPv6, ???
Various
Various

networker050184

theodoxa wrote: »

EIGRP uses its own Transport Layer Protocol called RTP (Reliable Transport Protocol).

RTP is not a transport layer protocol. It is basically just sequence numbers in the EIGRP packets.

FrankGuthrie

Notice the ??? with OSPF at Layer 4. If the IP protocol tell to which next layer protocol the /datapacket needs to be given, what is the Layer 4 protocol for OSPF ???

networker050184

Nothing. You have to remember the OSI is nothing but a model. Not everything fits perfectly into the little world of OSI.