4

I am trying to investigate a RIP packet. It clearly states that the packet is RIP v1. But its format does not match with the either RIP v1 or v2. Any ideas what this packet actually is?

enter image description here

  • You should use the verbose output (-vv) to get more information with the full protocol decode. – Ron Maupin Apr 23 at 18:56
  • 1
    I don't have further access to the system. Is it possible to decode via only this packet? @RonMaupin – Bat Apr 23 at 18:59
7

Given how simple RIP v1 is, this is pretty easy to do by eye from Figure 1 in the RFC 1058:

  • 5 longs from 45c0 is the IP header
  • 4 shorts from 0208 (the italic portion) is the UDP header
  • The rest from 0201 (the bold portion) is the RIP body
01:00:00.000000 IP 128.238.62.2.route > 255.255.255.255.route: RIPv1, Response, length: 44
    0x0000:  45c0 0048 0000 0000 0211 f8f5 80ee 3e02  E..H..........>.
    0x0010:  ffff ffff 0208 0208 0034 b9a0 0201 0000  .........4......
    0x0020:  0002 0000 80ee 3f00 0000 0000 0000 0000  ......?.........
    0x0030:  0000 0001 0002 0000 80ee 4000 0000 0000  ..........@.....
    0x0040:  0000 0000 0000 0002                      ........
  +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
  | command (1)   | version (1)   |      must be zero (2)         |
  +---------------+---------------+-------------------------------+
  | address family identifier (2) |      must be zero (2)         |
  +-------------------------------+-------------------------------+
  |                         IP address (4)                        |
  +---------------------------------------------------------------+
  |                        must be zero (4)                       |
  +---------------------------------------------------------------+
  |                        must be zero (4)                       |
  +---------------------------------------------------------------+
  |                          metric (4)                           |
  +---------------------------------------------------------------+

  The portion of the datagram from address family identifier through
  metric may appear up to 25 times.

We have:

command=02 version=01 mbz=0000
family=0002 mbz=0000 addr=80ee3f00 mbz=00000000 mbz=00000000 metric=00000001
family=0002 mbz=0000 adda=80ee4000 mbz=00000000 mbz=00000000 metric=00000002

But if you have more complex packets ...

One way to solve this kind of problem is to make a PCAP file from the data (with a tool or just a programming language such as python), and then use standard tools to examine it.

Your packet analysed with tshark is:

Internet Protocol Version 4, Src: 128.238.62.2, Dst: 255.255.255.255
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes (5)
    Differentiated Services Field: 0xc0 (DSCP: CS6, ECN: Not-ECT)
        1100 00.. = Differentiated Services Codepoint: Class Selector 6 (48)
        .... ..00 = Explicit Congestion Notification: Not ECN-Capable Transport (0)
    Total Length: 72
    Identification: 0x0000 (0)
    Flags: 0x0000
        0... .... .... .... = Reserved bit: Not set
        .0.. .... .... .... = Don't fragment: Not set
        ..0. .... .... .... = More fragments: Not set
        ...0 0000 0000 0000 = Fragment offset: 0
    Time to live: 2
        [Expert Info (Note/Sequence): "Time To Live" only 2]
            ["Time To Live" only 2]
            [Severity level: Note]
            [Group: Sequence]
    Protocol: UDP (17)
    Header checksum: 0xf8f5 [validation disabled]
    [Header checksum status: Unverified]
    Source: 128.238.62.2
    Destination: 255.255.255.255
User Datagram Protocol, Src Port: 520, Dst Port: 520
    Source Port: 520
    Destination Port: 520
    Length: 52
    Checksum: 0xb9a0 [unverified]
    [Checksum Status: Unverified]
    [Stream index: 0]
Routing Information Protocol
    Command: Response (2)
    Version: RIPv1 (1)
    IP Address: 128.238.63.0, Metric: 1
        Address Family: IP (2)
        IP Address: 128.238.63.0
        Metric: 1
    IP Address: 128.238.64.0, Metric: 2
        Address Family: IP (2)
        IP Address: 128.238.64.0
        Metric: 2
9

It's a RIPv1 packet. You're looking at the full IP packet. RIP starts at 0x001c.

  • The problem is that IP 128.238.62.2 (80ee 3e02) appears at the end of the first line. According to the rip v1, the previous 2 bytes should be zero but they have a value of f8f5. – Bat Apr 23 at 19:09
  • 4
    That's the source IP in the IP header. Then you have the UDP header, then you have the RIP packet starting at 0x001c. – Ron Trunk Apr 23 at 19:12
0

This is a response header. Response means ' A message containing all or part of the sender's routing table. This message may be sent in response to a request or poll, or it may be an update message generated by the sender.'

In addition to that you can see sender ip address.

If you want to see more details you can use -vv

  • Edited......... – infra Apr 24 at 11:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.