interface keepalive

[galit]

dear experts,

I couldn't find any document that detail the interface keepalive protocol (if I should call it a protocol). I will be gratefull if you redirect me to a document that cover this subject.

if there is no such reference, I would like to know:

1. what is this protocol and what is it good for?

2. why sometimes it's enabled and sometimes disabled by default?

3. I would like to disable it on all the intefaces of a new network I am about to build, what kind of behavior should I expect?

thank you in advaced, galit.

[spremkumar]

hi

keepalive packets are simple packets which are required to keep the check on the status of the interfaces.

its mostly configured in WAN,LAN and Tunnels interfaces so that if theres some probs or faults observed keepalive packets are useful to find out the same and bring the interfaces down.

keepalive default time period is 10seconds which you can bring it down to even 1 second for faster fault detections.

based on the same the interface will be brought down,routes will be removed from the routing table,backup will also trigger ..

for more info do find this link too...

http://www.cisco.com/univercd/cc/td/doc/product/software/ios123/123cgcr/inter_r/int_i1g.htm#wp1140571

regds

[Richard Burts]

Galit

As Edwin explains there is not really a protocol of keepalive. Keepalive messages are generated on most router interfaces as a way to track the status of the interface. The basic logic is that the router should only forward traffic out an interface if it believes that the traffic will be successful through that interface. So the router attempts to identify interfaces that will not pass traffic by sending and receiving keepalive messages. If the keepalives fail the router marks the interface as protocol down and will not forward any traffic out that interface.

You may deploy your new network and disable keepalives if you decide that you want to do this. The result will be that all interfaces that are not administratively shut down and that have keepalive disabled will report themselves as up/up even if they are not capable of passing traffic. This creates the possibility of black holes in your network (you send traffic into them but nothing ever goes through - and there are no error messages about it).

Be aware that some interfaces (especially point to point serial interfaces) actually send keepalive packets and need to receive keepalive packets to maintain the interface. If you disable keepalive on one end but not on the other end, then the end that still is attempting to process keepalives will never receive a response and will declare itself up/down no matter whether the link is passing data traffic or not.

If it were me I would not disable keepalives on an interface unless I had a really good reason to want to do so.

HTH

Rick

[galit]

hello again,

first, thanks a lot to both of you, Rick and Edwin.

second, I hope you can help me with the following:

1. how do non-cisco equipment respond to those messages?

2. I read somewhere that those messages are usefull for loop detection in LAN and maybe WAN also. is it true?

3. in the reference you send me, Edwin, it is writen that in Etherent "the IOS software send messages to itself" can you explain me what that means ?

again, thank you, Galit.

[Richard Burts]

Galit

1) Generally having non-Cisco equipment is not an issue for keepalives. On LAN media (Ethernet) no other device interacts with the keepalive. On WAN media if the device supports the protocol selected it will support the keepalive mechanism (whether it is HDLC or PPP or whatever).

2) Especially on HDLC links keepalives may be useful in detecting a looped condition. This is because within the HDLC keepalive there are sequence numbers (mineseen and yourseen). If the router sees packets being received with the same sequence numbers it can realize that it is seeing its own packets not packets from its neighbor.

3) In an Ethernet keepalive, if you look at the source MAC address you would see the address of the router - as you would expect. But if you look at the destination MAC address you would also see the router MAC address. So the source and destination are both the router. So the router is sending a message to itself.

HTH

Rick

[galit]

hi Rick,

I think that it will be better if I will leave the default configuration regarding this subject,

(which is on for WAN and off for LAN, isn't it?)

it will do only good.

thank you very much for your help.

Galit.