CODEWITHSUNDEEP
tcpdumpkeepalived
lyres
lyres

Reputation: 117

tcpdump shows vrrp traffic (proto 112) only if keepalived is run on the host

In our LAN we have several keepalived clasters (used different virtual_router_id of course) - all operating on multicast. The issue is that before installing and running keepalived on particular host I cannot sniff vrrp traffic by tcpdump:

Already checked firewalld, iptabels and sysctl net.ipv4.ip_nonlocal_bind - everything is OK. OS - RHEL 8.0

The need to see vrrp traffic before running keepalived is because we want to generate unique virtual_router_id before installing and running keepalived by checking what ids are already taken.

enter image description here

Upvotes: 0

Views: 3575

Answers (1)

S. Mao
S. Mao

Reputation: 11

  • no run keepalived server: don't use -i any and -p，more information man tcpdump; when your's keepalived instance use auth_type AH，proto is ah not vrrp，so suggest you use

tcpdump -i eth0 net 224.0.0.0/8

or

tcpdump -i eth0 vrrp or ah

  • run keepalived server: you can execute ip maddress show dev eth0,you will find add some change

    link 01:00:5e:00:00:12

    inet 224.0.0.18

so nic run promiscuity mode you can still capture packets

Upvotes: 1

Related Questions