EIGRP - Viewing RTP in Wireshark

When attempting to view the exchange of EIGRP messages using Wireshark, for the purpose of examining the operation of Reliable Transport Protocol (RTP), RTP will never explicitly be displayed in the packet captures.

Instead, you'll see something like this:

Frame 1: 86 bytes on wire (688 bits), 86 bytes captured (688 bits)
Ethernet II, Src: Cisco_8b:36:d0 (00:1d:a1:8b:36:d0), Dst: IPv4mcast_0a (01:00:5e:00:00:0a)
Internet Protocol Version 4, Src: 192.168.12.1, Dst: 224.0.0.10
Cisco EIGRP
    Version: 2
    Opcode: Hello (5)
    Checksum: 0xf1c1 [correct]
    [Checksum Status: Good]
    Flags: 0x00000000
    Sequence: 0
    Acknowledge: 0
    Virtual Router ID: 0 (Address-Family)
    Autonomous System: 12
    Parameters
    Software Version: EIGRP=6.0, TLV=3.0
    Peer Topology ID List

The components of RTP exist under the Cisco EIGRP section of the capture, but are not referred to as such. Specifically, the sequence and acknowledge values are used as part of the RTP process.

For more information about RTP take a look at:

RTP used with EIGRP should not be confused with the Real-time Transport Protocol which has the same acronym of "RTP."

Links:

https://forum.networklessons.com/t/eigrp-packet-how-is-it-packaged-for-network-distribution/14162/2?u=lagapidis