HSRP TTL values

[l.byford]

I am trying to verify the TTL info and understand why a 224.0.0.2 - "All Routers on local subnet" multicast ( the HSRP packets ) have a TTL of 2, seems weird to me as they shouldn't be capable of being 'routed' off the local subnet, please correct me. I have created a HSRP pair using 2 of our 2620's in our test rig and also see a TTL of 2, so expect that thats how it works.

Is this correct ?

The issue is currently in the hands of Netscreen as their 208 firewall (new model that problem seem particular to) appears to be taking in the hsrp packet, changing the source MAC to its own and dest MAC to that of the cisco virtual MAC and then pushing the packet back out of the same interface, again seems very wrong to me... The result of which is that the cisco 7200's cry foul and log a duplicate IP message as the packet source IP is still the same as when the cisco originally sent the packet out.

Anyone ever come across anything similar?

[nuno.morais]

Hi.

I've never looked at HSRP packets TTL values, but I think routers set TTL to 2 in order to avoid that upon receiving they have to send a ICMP TTL exceeded message, which might happen if TTL was set to 1. If a router receives an IP packet with TTL=1, it will decrement the TTL field which result TTL=0, which normally causes the router to send an ICMP TTL exceeded message to the source of the packet.

I'm not sure about this, but anyway...

Rgds.

Nuno Morais

[l.byford]

Yes,youre not the only one. I see what you mean about TTL=1, but the RFC (2281) seems to state that HSRP will use a TTL of 1.

All very strange. I suspect this is an issue for Netscreen, but we will see.

lee.

[Gilles Dufour]

I checked the code and we are effectively using a TTL = 2.

The reason is that we use our internal default TTL.

In other words, this value is also used for Rip update. And the reason it's 2 and not 1 is for compatibility reason with some old (other vendor) devices (talking about rip).