Packet analysis lab 10 of 12
Routing protocol packets: why OSPF and BGP neighbours fail
Three core routers won't form their neighbours. You tap the core, read OSPF hellos, database descriptions and BGP OPEN and NOTIFICATION messages, find a hello-interval mismatch, an MTU mismatch and a wrong AS number from the packets alone, capture BGP on the router itself with embedded packet capture, and fix all three.
Run this lab
It needs Lite: its 4 nodes are set to 4 vCPU and 2,560 MB in total. That fits the free demo too.
In your workspace: Shared, then Packet analysis with Wireshark and tcpdump guided labs, then 10 - Routing protocol packets - why OSPF and BGP neighbours fail
- Level
- Advanced
- Time
- About 75 minutes
- Nodes need
- 4 vCPU, 2,560 MB
- Smallest plan
- Lite
The scenario
Fellside Outdoor's core LAN joins three routers: R1 (Kendal), R2 (Penrith, with the partner extranet behind it) and R3 (the warehouse). They should all be OSPF neighbours in area 0, and R1 and R2 should exchange the extranet routes over iBGP in AS 65001. After a weekend of changes, nothing is adjacent and the extranet is unreachable. The change log is lost. You'll diagnose all of it from packets: your workstation WS taps R1's link to the core.
| Device | Interface | Address | Router ID | Notes |
|---|---|---|---|---|
| R1 | Gi0/0 | 10.110.0.1/24 | 1.1.1.1 | OSPF priority 50; iBGP to R2 |
| R2 | Gi0/0 | 10.110.0.2/24 | 2.2.2.2 | OSPF priority 100; iBGP to R1; Lo1 172.16.20.0/24 |
| R3 | Gi0/0 | 10.110.0.3/24 | 3.3.3.3 | OSPF only |
| WS | br0 (eth0 + eth1) | 10.110.0.50/24 | none | tap between R1 and the core; TFTP server |
Your workstation, WS. Open WS's console (a remote desktop, root / eve), start Wireshark from Applications > Internet > Wireshark, and capture on br0. Write answers in /root/answers.txt (pluma /root/answers.txt &).
What you’ll practise
- Read OSPF packets: hello fields, DR and BDR, database description and the interface MTU
- Explain why OSPF neighbours stick in INIT, EXSTART or EXCHANGE from the packets
- Read BGP messages over TCP 179: OPEN, UPDATE, KEEPALIVE and NOTIFICATION
- Capture on a router with Cisco embedded packet capture, filter it with an ACL and export it to Wireshark
- Fix hello-interval, MTU and AS-number faults and prove the neighbours come up
The tasks
- OSPF hellos
- Stuck in EXSTART: database descriptions
- BGP: OPEN and NOTIFICATION
- Capture on the router itself
- Fix all three and prove it
The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.
Topology and devices
The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.
Every link, as text
- R1
Gi0/0to WSeth0 - WS
eth1to Core (network) - R2
Gi0/0to Core (network) - R3
Gi0/0to Core (network)
| Node | Device | Image in Add Node | Set to |
|---|---|---|---|
| R1 | Cisco IOSv | vios-adventerprisek9-m.SPA.159-3.M6 | 1 vCPU, 512 MB |
| WS | EVE-NG GUI server (Docker) | eve-gui-server:latest | 1 vCPU, 1,024 MB |
| R2 | Cisco IOSv | vios-adventerprisek9-m.SPA.159-3.M6 | 1 vCPU, 512 MB |
| R3 | Cisco IOSv | vios-adventerprisek9-m.SPA.159-3.M6 | 1 vCPU, 512 MB |
How to open this lab
Sign in to your workspace at
lab.cloudlabbox.com.In File Manager, open Shared, then the folder
Packet analysis with Wireshark and tcpdump guided labs.Open
10 - Routing protocol packets - why OSPF and BGP neighbours failand start its nodes, then open Lab Tasks for the scenario and the steps.
The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.
More Packet analysis labs
Related labs in other courses
CloudLabBox is independent of the Wireshark Foundation, CompTIA and Cisco. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.