cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1066
Views
0
Helpful
3
Replies

L2TPv3 Traffic Spam

I have been testing a L2TPv3 pseudowire setup for implementation as a layer 2 vpn solution over an Ethernet / IP backbone. My network hardware doesn't support MPLS so we have chosen to go with L2TPv3.

In the test environment I have managed to get the two Customer-Edge (CE) devices communicating with each other at layer 2 across the IP backbone.

As part of the testing process I ran a packet sniffer at different points in the CE and Provider (P) networks. From this I have discovered that L2TPv3-encapsulated packets are being spammed in one direction on the data channel without any apparent reason. This traffic appears to be generated at one of the Provider-Edge (PE) routers but I have been unable to determine the cause. Control channel messages are behaving normally.

The following image is a diagram of the test setup:

L2TPv3_1.png

And the next shows the wireshark locations and numbers:

L2TPv3_2.png


I have also attached the following in hopes that you might assist me in discovering the root cause of this issue:

- Wireshark feeds for each point in the path in both directions (in .pcap and .txt format)
- Configuration files for each device in the test case

Wireshark feed ws6 shows the spammed traffic (it is of the direction PE2 > PE1).

Please note that the Wireshark captures were taken over a 70 second period and in each case begun and concluded with 5 ICMP echo requests from a CE switch with datagram size set to 1400.

Happy to provide further information or alternative file formats.

Thanks in advance for your assistance.

Message was edited by: Michael Honeyman Moved to a different community. Also - the order of the spammed encapsulated traffic on the wire seems to go 98 bytes, 106 bytes, 102 bytes.

3 Replies 3

Herbert Baerten
Cisco Employee
Cisco Employee

Hi Michael,

the Security > VPN forum mainly deals with encrypted (IPsec) VPN, not so much with L2TPv3. I think you may get better results if you move this thread (or start a new one) in the or possibly some other group under Network Infrastructure.

hth

Herbert

Thanks for the advice Herbert. I've moved the thread to WAN, Routing and Switching.

It turns out that this was BPDU messages being exchanged between the two 2960s (every 2 seconds by default). The SPAN ports do not capture many layer 2 protocols by default which I was unaware of so had previously ruled out spanning tree as a cause.

Review Cisco Networking for a $25 gift card