Strange ip addresses in multicast VRRP/CARP packets



  • I have  setup a carp failover enviroment built on non internet connected devices.
    This works as expected. But I do notice some strange activity in the packets details to vrrp 224.0.0.18.
    In wireshark in the packet details it's announcement I noticed  the following ip addresses in the packets.

    152.162.185.107
    ANS Communications, Inc (ANS) US

    1.178.202.190
    iseek Communications Australia

    215.25.75.153
    DoD Network Information Center (DNIC) US

    184.11.30.16
    Frontier Communications of America, Inc. US

    134.138.168.76
    RIPE-ERX-134-138-0-0 Sweden

    160.46.170.143
    BMW AG, Berlin production plant BMW Germany

    204.253.163.175
    Verizon Business US

    The interfaces part of a /29 network and on a interface with no vlan on the pfsense but it has it's own vlan number on the switch

    I hope somebody can give me an answer to this question.

    I am running on 2.3.4_1 enviroment



  • @Tino010:

    I have  setup a carp failover enviroment built on non internet connected devices.
    This works as expected. But I do notice some strange activity in the packets details to vrrp 224.0.0.18.

    Try decoding the carp packets as carp, and not vrrp.



  • Yeap, carp is not the same protocol as vrrp although they share the same protocol number in the IP headers.


  • Netgate

    Yeah what kind of connection is this on? You will see any other CARP/VRRP on that broadcast/multicast domain. Strange to see such varying IP addresses but it depends on what you're connected to.

    You can set Wireshark to decode protocol 112 as CARP though. Those other multicasts might actually be VRRP though. They can coexist.