EIGRP - Viewing RTP in Wireshark
When attempting to view the exchange of EIGRP messages using Wireshark, for the purpose of examining the operation of Reliable Transport Protocol (RTP), RTP will never explicitly be displayed in the packet captures.
Instead, you'll see something like this:
Frame 1: 86 bytes on wire (688 bits), 86 bytes captured (688 bits) Ethernet II, Src: Cisco_8b:36:d0 (00:1d:a1:8b:36:d0), Dst: IPv4mcast_0a (01:00:5e:00:00:0a) Internet Protocol Version 4, Src: 192.168.12.1, Dst: 224.0.0.10 Cisco EIGRP Version: 2 Opcode: Hello (5) Checksum: 0xf1c1 [correct] [Checksum Status: Good] Flags: 0x00000000 Sequence: 0 Acknowledge: 0 Virtual Router ID: 0 (Address-Family) Autonomous System: 12 Parameters Software Version: EIGRP=6.0, TLV=3.0 Peer Topology ID List
The components of RTP exist under the Cisco EIGRP section of the capture, but are not referred to as such. Specifically, the sequence and acknowledge values are used as part of the RTP process.
For more information about RTP take a look at:
- Reliable Transport Protocol
- EIGRP - RTP's reliable message exchange process
- EIGRP - SIA Process and RTP retry attempts
- EIGRP - Update message exchange process
- EIGRP - Reliable Multicast
- EIGRP SIA timers
RTP used with EIGRP should not be confused with the Real-time Transport Protocol which has the same acronym of "RTP."