EIGRP Behavior question

[RICHARD MESSINGER]

Have an odd situation come up and I want to be sure that I am on semi solid ground.

The customer has a Metro-E network connecting several locations.  They are using EIGRP as the routing protocol and they have a GRE tunnels through the Internet for backup connecitons back to their core.

Metro-E was processing and handling the multicast just fine until there was a software update that started to enforce a block on MultiCast packets.  The strange thing from the customer is that the routers did not loose their neighbor associations and traffic continued to router just fine until one of the locations had a power outage and the router was restarted.  At this point when it sent out its initial Hello's it did not see anything coming back so all traffic then went out the tunnel.

The question I am trying to find a good answer is "Is this to be expected behavior" in that the router in question would have sent unicast hello packets to its already established neighbors when the multicast packets initially stopped coming?

And should there be something in the logs of the neighbors that this may have happened, since we lost the logs on the router when it lost power?

Thanks.

[Peter Paluch · Accepted solution]

Hi Richard,

No, what you have described is definitely not an expected behavior. If EIGRP is not configured with static neighbors, it uses multicast Hellos all the time. EIGRP falls back to unicast only with reliable packets that can initially be multicasted - Query and Update. EIGRP does not fall back to using unicast Hello packets when multicast Hellos appear to be gone.

Frankly, I am at a loss at what could have happened. I am sure you understand there is very little information here to come up with a possible hypothesis.

Can you perhaps describe the entire event in more detail including related facts? For example, you have mentioned that some sort of multicast blocking took place. Was that a total block, i.e. no multicasts passed whatsoever, or did it merely cause a possibly significant portion of multicasts get lost but some could have made it? How many neighbors are there? Is it an any-to-any service, or is it an E-Tree to resemble a hub-and-spoke topology?

Whatever more details you can provide, no matter how insignificant they may seem, the better.

Best regards,
Peter

[RICHARD MESSINGER]

Peter,

What I have stated is about all the information that I have.  I was hoping for a "that would make sense" answer but from what I know and read that was not the way it would have worked. 

The logs in the routers thatwould have given me the information is gone.

Will consider your answer as correct.

Thank you

[Peter Paluch]

Hi Richard,

Please do not consider my original plea for more information as being critical toward you in any way. The fact is that the behavior you have described is absolutely non-standard, and I would very much like to help and know myself what could have happened. Unfortunately, from the available information, I do not know where to start for clues, as the entire incident does not resemble any failure mode I've ever seen with EIGRP.

I am sorry I could not help.

Best regards,
Peter