EIGRP Packets

* Technically, EIGRP is a transport layer function, since it runs on top of IP.
* EIGRP packets are encapsulated directly in IP with the protocol field set to 88.
* The source IP address is the IP address of the interface from which the packet is issued.
* The destination IP address in EIGRP depends on the packet type.

EIGRP uses a mixture of MULTICAST and UNICAST packet transmission.
Multicast address for EIGRP: (IPv4) 224.0.0.10    (IPv6) FF02::a
Multicast is link-local, so that packets do not propagate beyond the local subnet.

Packets may be reliable (Ack required) or unreliable (Ack not required).

EIGRP uses five packet types:

• Hello: Used to discover neighbour before establishing adjacency. EIGRP Hellos are sent as multicasts and contain an acknowledgment number of 0. They do not need acknowledgement. A Hello with no data is also used as an acknowledgment. Acknowledgements are always sent using a unicast address and contain a non−zero acknowledgment number.

• Updates: Used to convey reachability of destinations. When a new neighbor is discovered, update packets are sent so the neighbor can build its topology table. EIGRP Updates are sent as multicasts when a new route is discovered or when convergence is completed; and are sent as unicasts when synchronizing topology tables with neighbors upon the EIGRP startup. They are sent reliably between EIGRP routers.

• Queries: Sent when destinations go into ACTIVE state. EIGRP Queries are sent reliably as multicasts.

• Reply: Replies are always sent in response to queries to indicate to the originator that it does not need to go into ACTIVE state because it has feasible successors. Replies are reliably unicast to the originator of the query.

• Request: Used to get specific information from one or more neighbours. They can be multicast or unicast. Requests are transmitted unreliably.

Summary:

Hello – unreliable, multicast

Ack – unreliable, unicast

Query - reliable, multicast

Update – reliable, multicast

Reply – reliable, unicast

PACKET FORMAT:
Following the IP Header is the EIGRP header.

The fields are as follows:
* Version: EIGRP Process version.
* OpCode: Specifies the types of EIGRP packet contained:
      1 = Update
      3 = Query
      4 = Reply
      5 = EIGRP hello packet
* Checksum: for the entire EIGRP packet, excluding the IP header.
* Flags: Only the first two bits are used, the rest of the bits are unused.
         Bit 1: Init bit, used in new neighbour relationship
         Bit 2: Conditional receive bit
* Sequence Number: Used by RTP.
* Acknowledgement Number: Used by RTP.
* Autonomous System Number: identifies the EIGRP process issuing the packet. The EIGRP process receiving the packet will process the packet only if the receiving EIGRP process has the same AS number; otherwise, the packet will be discarded.

The fields following the EIGRP header depend upon the OpCode specified.
Here are a few TLVs that are commonly used:

1. Parameter TLV: This contains the parameters that the two neighbours must agree upon to establish a
    neighbour relationship.
Type = 0x0001, Size: 12 bytes.

2. IP internal route TLV: Internal Routes are routes contained within an EIGRP domain, i.e. routes 
    originated from the same EIGRP AS number as the receiving router. 
Type: 0x0102, Size: 28 bytes.


* Next hop — IP address of the next hop to which packets should be forwarded.
* Delay — Delay parameter of the route metric. The delay value is the sum of all the delay parameters
   on the interface across the path to the destination network.
* Bandwidth — Bandwidth parameter of the route metric. The bandwidth is obtained from the interface,
    and it is the lowest bandwidth on the interface across the path to the destination network.
* MTU — The interface MTU parameter of the route metric.
* Hop count — Number of hops to the destination network.
* Reliability — The reliability of the interface, out of a possible range of 1 to 255. A reliability of 1
   indicates that the reliability is 1/255, whereas a reliability of 255 indicates that the interface is 100
   percent reliable.
* Load — The load of the interface, out of a possible range of 1 to 255. A load value of 1 indicates that
   the interface has a very light load, while a load value of 255 indicates that the interface is highly
   saturated.
* Prefix length — The subnet mask of the destination network.

3. IP external route TLV: An external route contains a destination network outside an EIGRP domain,
   eg: redistributed routes from other routing processes into an EIGRP domain.
Type: 0x0103, Size: 48 bytes.

Most of the fields are the same as that of the Internal Route packet. The extra fields are mentioned below:

* Originating router — The router ID of the router that originates the external EIGRP routes.
* Originating AS number— The EIGRP AS number of the routes before getting redistributed into this
   EIGRP autonomous number.
* External protocol metric — The metric of the routes before getting redistributed into EIGRP.
* External protocol ID — The type of routing protocol that originates the routes that were redistributed
   into EIGRP. The values are IGRP(0x01), EIGRP(0x02), RIP(0x04), OSPF(0x06), BGP (0x09), etc.
*Arbitrary Tag — is used to carry route maps.