[Help] Is there any way to view HSRP packets on Wireshark between the two gateways?

[struong222]

I currently have this network layout in my school lab and I am stumped on finding HSRP packets between the gateways of 10.21.1.25 and 10.21.1.35 or 192.168.2.2 and 192.168.2.1. I have tried to monitor the traffic of Fa0/1 on the Cisco 3750 but the host PC could not find any HSRP packets (I monitored the source port (Fa0/1) and the destination port I chose was Fa0/10 which I plugged the VLAN 10 host to). I also plugged the VLAN 10 host directly to the router to find any packets. That did not work either. Is there any way to monitor or mirror traffic that the VLAN 10 host is connected to the 3750 switch to view the HSRP packets? I just want some guidance.

[Jaderson Pessoa]

Dear struong222, Do you need monitor which gateway your end device use? or need monitor hsrp packets? You can check it using debug ip standby on own router.

Maybe i was dont understandood your doubt.

[Mark Malone]

To debug all HSRP error events, use the following command:

Router2#debug standby errors

The events keyword will display information about HSRP events:

Router2#debug standby events

With the packets keyword, you can look at the contents of all HSRP packets:

Router2#debug standby packets

You can use the terse keyword to see a short form of all HSRP errors, events, and packets:

Router2#debug standby terse

Using wireshark you should be able to see the multicast address but debugging you will see all packets

hsrpv1 224.0.0.2

hsrpv2 224.0.0.102

[Joseph W. Doherty]

You need two things.

First, your PC must have a NIC that supports running in "promiscuous mode".

Second, your PC must have a physical connection where it can actually "see" the traffic. This might be accomplished by placing a "hub" in-line on one of the transit links, or by connecting to a switch port which is "mirroring" another switch port (the one with the transit traffic of "interest" on it).