pfSense Support Subscription

Author Topic: Strange ip addresses in multicast VRRP/CARP packets  (Read 155 times)

0 Members and 1 Guest are viewing this topic.

Offline Tino010

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
    • View Profile
Strange ip addresses in multicast VRRP/CARP packets
« on: October 09, 2017, 07:22:12 am »
I have  setup a carp failover enviroment built on non internet connected devices.
This works as expected. But I do notice some strange activity in the packets details to vrrp 224.0.0.18.
In wireshark in the packet details it's announcement I noticed  the following ip addresses in the packets.

152.162.185.107
ANS Communications, Inc (ANS) US

1.178.202.190
iseek Communications Australia

215.25.75.153
DoD Network Information Center (DNIC) US

184.11.30.16
Frontier Communications of America, Inc. US

134.138.168.76
RIPE-ERX-134-138-0-0 Sweden

160.46.170.143
BMW AG, Berlin production plant BMW Germany


204.253.163.175
Verizon Business US


The interfaces part of a /29 network and on a interface with no vlan on the pfsense but it has it's own vlan number on the switch


I hope somebody can give me an answer to this question.

I am running on 2.3.4_1 enviroment

Offline dotdash

  • Hero Member
  • *****
  • Posts: 1915
  • Karma: +99/-2
    • View Profile
Re: Strange ip addresses in multicast VRRP/CARP packets
« Reply #1 on: October 09, 2017, 10:19:55 am »
I have  setup a carp failover enviroment built on non internet connected devices.
This works as expected. But I do notice some strange activity in the packets details to vrrp 224.0.0.18.
Try decoding the carp packets as carp, and not vrrp.

Offline kpa

  • Hero Member
  • *****
  • Posts: 1178
  • Karma: +131/-6
    • View Profile
Re: Strange ip addresses in multicast VRRP/CARP packets
« Reply #2 on: October 09, 2017, 10:43:39 am »
Yeap, carp is not the same protocol as vrrp although they share the same protocol number in the IP headers.

Offline Derelict

  • Global Moderator
  • Hero Member
  • *****
  • Posts: 9078
  • Karma: +1037/-306
    • View Profile
Re: Strange ip addresses in multicast VRRP/CARP packets
« Reply #3 on: October 09, 2017, 11:05:09 am »
Yeah what kind of connection is this on? You will see any other CARP/VRRP on that broadcast/multicast domain. Strange to see such varying IP addresses but it depends on what you're connected to.

You can set Wireshark to decode protocol 112 as CARP though. Those other multicasts might actually be VRRP though. They can coexist.
Las Vegas, Nevada, USA
Use this diagram to describe your issue.
The pfSense Book is now available for just $24.70!
Do Not PM For Help! NO_WAN_EGRESSTM