where is 224.0.0.2 coming from ?

[wfqk]

Hi All

The following is ip packet debug output. I know 224.0.0.10, but where does 224.0.0.2 come from ? why do the len is 48 instead of 60 ? Thank you

R3(config-if)#
*Mar  1 00:47:46.551: IP: s=3.1.1.4 (Vlan3), d=224.0.0.10, len 60, rcvd 2
*Mar  1 00:47:46.687: IP: s=3.1.1.2 (Vlan3), d=224.0.0.10, len 60, rcvd 2
*Mar  1 00:47:47.111: IP: s=4.1.1.3 (local), d=224.0.0.10 (Vlan4), len 60, sending broad/multicast
*Mar  1 00:47:47.183: IP: s=3.1.1.3 (local), d=224.0.0.2 (Vlan3), len 48, sending broad/multicast
*Mar  1 00:47:47.487: IP: s=3.1.1.4 (Vlan3), d=224.0.0.2, len 48, rcvd 0
R3(config-if)#
*Mar  1 00:47:49.651: IP: s=3.1.1.3 (local), d=224.0.0.10 (Vlan3), len 60, sending broad/multicast
*Mar  1 00:47:50.183: IP: s=3.1.1.3 (local), d=224.0.0.2 (Vlan3), len 48, sending broad/multicast
*Mar  1 00:47:50.515: IP: s=3.1.1.4 (Vlan3), d=224.0.0.2, len 48, rcvd 0

[Charles Hill · Accepted solution]

Hello showipinterface,

224.0.0.2 is the all routers multicast address, which is used for the HSRP hello packets.

Here is a link that has info for HSRP.

http://www.cisco.com/c/en/us/support/docs/ip/hot-standby-router-protocol-hsrp/9281-3.html

Hope this helps.

[e.ciollaro · Accepted solution]

Correct but there are other protocols using that address: IGMP and LDP at least, but I suppose many other.

[Charles Hill]

Very true.  I should have added that other protocols use 224.0.0.2 as well. 

  I was basing it on a previous posting showip had made that showed HSRP was configured in his network.