Wait... Did I miss something? (OSPF question)

So as I was just studying and doing some labs I saw something that confused me...

I have one real router hooked into a switch and I have it set as the DR, even confirmed it. Then I have another dynamips router running and I exempted it from the election by setting it's priority to 0 (confirmed there is no BDR). OSPF is running, the real router is redistributing some rip routes it is getting from a netgear and linksys router behind it, dynamips router is getting the routes all seems good... Got bored with playing with them so I turned on ospf events debugging and have the output scrolling along nicely on one monitor while I am watching CBT Nuggets on another... But I noticed something weird with the debugs. BOTH routers are sending sending to 224.0.0.5... WTF? I thought the DROTHER (dynamips router) was supposed to send to 224.0.0.6?

Did I miss that if you exempt a router from the election it will send to 224.0.0.5? Can someone explain why 224.0.0.6 isn't being used? Or have I just been up too long and did something stupid or have something confused?

Edit: Forgot to add, I cleared the ospf process on both a few times and even tried adding new networks and same thing.

Find more posts tagged with

Save $250 on 2025 certification boot camps from Infosec!

Book now with code EOY2025

Button

Comments

kpjungle

scheistermeister wrote:

So as I was just studying and doing some labs I saw something that confused me...

I have one real router hooked into a switch and I have it set as the DR, even confirmed it. Then I have another dynamips router running and I exempted it from the election by setting it's priority to 0 (confirmed there is no BDR). OSPF is running, the real router is redistributing some rip routes it is getting from a netgear and linksys router behind it, dynamips router is getting the routes all seems good... Got bored with playing with them so I turned on ospf events debugging and have the output scrolling along nicely on one monitor while I am watching CBT Nuggets on another... But I noticed something weird with the debugs. BOTH routers are sending sending to 224.0.0.5... WTF? I thought the DROTHER (dynamips router) was supposed to send to 224.0.0.6?

Did I miss that if you exempt a router from the election it will send to 224.0.0.5? Can someone explain why 224.0.0.6 isn't being used? Or have I just been up too long and did something stupid or have something confused?

Edit: Forgot to add, I cleared the ospf process on both a few times and even tried adding new networks and same thing.

Sure its not just hello messages?

scheistermeister

kpjungle wrote:

Sure its not just hello messages?

That's why I added a network to the dynamips router; to test for that and still everything was sent to 224.0.0.5. Just watched it go right on through.

kpjungle

scheistermeister wrote:

kpjungle wrote:

Sure its not just hello messages?

That's why I added a network to the dynamips router; to test for that and still everything was sent to 224.0.0.5. Just watched it go right on through.

Ive got it setup here, only in dynamips though, where i have a router exempt from being a dr/bdr (with ospf priority 0), and i redistribute some connected routes into the OSPF domain. It will still send these two the DR (i can see the dr receive them on multicast 224.0.0.6 through debug ip packet), it will still send out the hellos on 224.0.0.5.

scheistermeister

kpjungle wrote:

Ive got it setup here, only in dynamips though, where i have a router exempt from being a dr/bdr (with ospf priority 0), and i redistribute some connected routes into the OSPF domain. It will still send these two the DR (i can see the dr receive them on multicast 224.0.0.6 through debug ip packet), it will still send out the hellos on 224.0.0.5.

That just gave me an idea. Does the DROTHER send to both 224.0.0.5 and 224.0.0.6 at the same time and only show the 224.0.0.5 with the debug ip ospf events? Because I watched the debug on the DROTHER and it showed sending a LSU to 224.0.0.5 and I saw the DR receive it, but with debug ip ospf event it doesn't show from which multicast address it received it.

Give me a few and I will use debug ip packet instead.

scheistermeister

Yup, that's what it was. Thanks for that.

kpjungle

scheistermeister wrote:

Yup, that's what it was. Thanks for that.

A DROther sends LSU's to both 224.0.0.5 and 224.0.0.6 ?

scheistermeister

kpjungle wrote:

A DROther sends LSU's to both 224.0.0.5 and 224.0.0.6 ?

This is what I got from the debug ip packet

Mar  1 01:30:48.430: IP: s=192.168.1.7 (local), d=224.0.0.6 (FastEthernet0/0), len 96, sending broad/multicast
Mar  1 01:30:48.438: IP: s=192.168.1.3 (FastEthernet0/0), d=224.0.0.5, len 96, rcvd 0
Mar  1 01:30:49.924: %LINK-5-CHANGED: Interface Loopback2, changed state to administratively down
Mar  1 01:30:50.013: IP: s=192.168.1.7 (local), d=224.0.0.5 (FastEthernet0/0), len 80, sending broad/multicast

But that could be a hello that was coming through. Let me change the timers and try again. It also could have been that when I saw it before it sent a hello and the LSU at the same time which I think would be more accurate since the length of the packets above are different.

kpjungle

scheistermeister wrote:
kpjungle wrote:

A DROther sends LSU's to both 224.0.0.5 and 224.0.0.6 ?

This is what I got from the debug ip packet
Mar  1 01:30:48.430: IP: s=192.168.1.7 (local), d=224.0.0.6 (FastEthernet0/0), len 96, sending broad/multicast
Mar  1 01:30:48.438: IP: s=192.168.1.3 (FastEthernet0/0), d=224.0.0.5, len 96, rcvd 0
Mar  1 01:30:49.924: %LINK-5-CHANGED: Interface Loopback2, changed state to administratively down
Mar  1 01:30:50.013: IP: s=192.168.1.7 (local), d=224.0.0.5 (FastEthernet0/0), len 80, sending broad/multicast
But that could be a hello that was coming through. Let me change the timers and try again. It also could have been that when I saw it before it sent a hello and the LSU at the same time which I think would be more accurate since the length of the packets above are different.

Yeah, a good idea with the timers... My output looks very similar too. The exempt router sends a packet to 224.0.0.6 and immediately receives a packet from the DR specifying the new LSA. but the hello is still 10 sec on my setup, so it interfere with the output....

scheistermeister

Yup, it was just a hello that was sent at the same time. The DROTHER is only sending the LSU to 224.0.0.6.

It would have been nice if debug ip ospf event would have shown it was sending the LSU to 224.0.0.6 like it does hellos to 224.0.0.5. Damn confusing close timers!

kpjungle

scheistermeister wrote:

Yup, it was just a hello that was sent at the same time. The DROTHER is only sending the LSU to 224.0.0.6.

It would have been nice if debug ip ospf event would have shown it was sending the LSU to 224.0.0.6 like it does hellos to 224.0.0.5. Damn confusing close timers!

Hehe, yeah, it can get very confusing. Im still very confused about LSP and ISIS myself

scheistermeister

kpjungle wrote:

Hehe, yeah, it can get very confusing. Im still very confused about LSP and ISIS myself

Why is that? I personally love ISIS but I hate OSPF.

kpjungle

scheistermeister wrote:

kpjungle wrote:

Hehe, yeah, it can get very confusing. Im still very confused about LSP and ISIS myself

Why is that? I personally love ISIS but I hate OSPF.

I think the study guide and exam cert guide made me really unsure about adjacencies. It states that adjacencies are created amont all IS routers, unlike OSPF. As far as I can debug myself to, LSP's (the LSA in ISIS), are being sent from individual IS's and not by a central DR (DIS in ISIS lingo), as far as i can see only the CSNP is sent from the DIS. They all learn individually from all other routers. According to the material they would have a DIS being the same as a DR, but i just dont see that happening.

scheistermeister

kpjungle wrote:

I think the study guide and exam cert guide made me really unsure about adjacencies. It states that adjacencies are created amont all IS routers, unlike OSPF. As far as I can debug myself to, LSP's (the LSA in ISIS), are being sent from individual IS's and not by a central DR (DIS in ISIS lingo), as far as i can see only the CSNP is sent from the DIS. They all learn individually from all other routers. According to the material they would have a DIS being the same as a DR, but i just dont see that happening.

No that you mention it they don't explain that do they? Another thing I noticed was in a practice test I had from Cisco Press on the old BSCI (642-801) it asked what happened when the DIS went down, but I never remembered reading about that.

I assumed that questions like that were too in depth and wouldn't be asked on the new cert test. I could have just forgotten I read it though.

That reminds me of a question I had on a Net Acad practice final for BCMSN that the whole class was going over together. It showed a topology with BGP running and something else, maybe GLBP. Well something was broke and all the answers except one listed something to do with BGP being the problem. When the instructor asked which it was I promptly said the answer that did not have BGP in it. When asked why my first response was because this is a test for BCMSN and not for BSCI, and BGP is not covered in this test so no prior knowledge of BGP is required and they would not test us on it. The whole class laughed and then I explain the other reason that was the correct answer.

kpjungle

scheistermeister wrote:

kpjungle wrote:

I think the study guide and exam cert guide made me really unsure about adjacencies. It states that adjacencies are created amont all IS routers, unlike OSPF. As far as I can debug myself to, LSP's (the LSA in ISIS), are being sent from individual IS's and not by a central DR (DIS in ISIS lingo), as far as i can see only the CSNP is sent from the DIS. They all learn individually from all other routers. According to the material they would have a DIS being the same as a DR, but i just dont see that happening.

No that you mention it they don't explain that do they? Another thing I noticed was in a practice test I had from Cisco Press on the old BSCI (642-801) it asked what happened when the DIS went down, but I never remembered reading about that.

I assumed that questions like that were too in depth and wouldn't be asked on the new cert test. I could have just forgotten I read it though.

That reminds me of a question I had on a Net Acad practice final for BCMSN that the whole class was going over together. It showed a topology with BGP running and something else, maybe GLBP. Well something was broke and all the answers except one listed something to do with BGP being the problem. When the instructor asked which it was I promptly said the answer that did not have BGP in it. When asked why my first response was because this is a test for BCMSN and not for BSCI, and BGP is not covered in this test so no prior knowledge of BGP is required and they would not test us on it. The whole class laughed and then I explain the other reason that was the correct answer.

Hehehe. Not always the most logical approach to things. I guess they might not test you on it, it just annoys the living daylight out of me

kpjungle

Do you happen to use the lab portfolio for BSCI?

scheistermeister

kpjungle wrote:

Do you happen to use the lab portfolio for BSCI?

Nope. I usually just think of the most complex or odd ball things I can. If I am having problems with ideas I check the labs from the Net Acad program. They have some good topologies in them.

Did you see the link I posted in your thread?

Plazma

scheistermeister wrote:

kpjungle wrote:

Do you happen to use the lab portfolio for BSCI?

Nope. I usually just think of the most complex or odd ball things I can. If I am having problems with ideas I check the labs from the Net Acad program. They have some good topologies in them.

Thats what I do, I have a few structured labs already to help me get the feel for things.. but I have a few base topologies I use for different scenarios and they are custom made by me. I try to have one "big lab" where i incorporate everything I know so far.

kpjungle

scheistermeister wrote:

kpjungle wrote:

Do you happen to use the lab portfolio for BSCI?

Nope. I usually just think of the most complex or odd ball things I can. If I am having problems with ideas I check the labs from the Net Acad program. They have some good topologies in them.

Did you see the link I posted in your thread?

Yep I did, thanks. I need to lab it some more today, cause im still positive that each ISIS thats non DIS still floods LSP's and not the DIS

kpjungle

Plazma wrote:

scheistermeister wrote:

kpjungle wrote:

Do you happen to use the lab portfolio for BSCI?

Nope. I usually just think of the most complex or odd ball things I can. If I am having problems with ideas I check the labs from the Net Acad program. They have some good topologies in them.

Thats what I do, I have a few structured labs already to help me get the feel for things.. but I have a few base topologies I use for different scenarios and they are custom made by me. I try to have one "big lab" where i incorporate everything I know so far.

Im not very good at thinking up stuff im afraid. There should be some kind of repository with labs