In a Virtual Router Redundancy Protocol (VRRP) operation, the VRRP primary device sends advertisements to the backup devices at regular intervals, the default interval being 1 second. If a backup device does not receive an advertisement for a specified period, the backup device with the next highest priority takes over as the primary device and begins forwarding packets.

However, these advertisement packets cannot be captured by the egress filter in the VRRP primary chassis, but can be captured by the ingress filter in the VRRP backup chassis.

This article provides more details and demonstrates how to capture the advertisement packets using an ingress filter.

Lab Topology

                          LS-r2
                              |
LS-r1(vrrp master)     LS-r3(vrrp backup)
      ge-0/0/4.0          ge-0/0/5.0
                   |                   |
             ---------EX2300--------
                            |
                         LS-r4  
LS-r1/r2/r3 belongs to MX480

Test

labroot@jtac-mx480-r2012-re0> show vrrp logical-system r1       
Interface     State       Group   VR state VR Mode   Timer    Type   Address
ge-0/0/4.0    up              1   master   Active      A  0.457 lcl    10.1.1.1      
                                                                vip    10.1.1.254 
 
labroot@jtac-mx480-r2012-re0> show vrrp logical-system r3   
Interface     State       Group   VR state VR Mode   Timer    Type   Address
ge-0/0/5.0    up              1   backup   Active      D  2.748 lcl    10.1.1.2      
                                                                vip    10.1.1.254    
                                                                mas    10.1.1.1 

                                                  <<<< VRRP is working fine.

Filter: test-out-ge-0/0/4.0-o                                 
Counters:
Name                                                Bytes              Packets
vrrp-out-ge-0/0/4.0-o                                   0                    0 <<< No VRRP packet increase in VRRP primary egress 
 
Filter: test-in-ge-0/0/5.0-i                                  
Counters:
Name                                                Bytes              Packets
vrrp-in-ge-0/0/5.0-i                                 4960                  124 <<< VRRP packet increasing in VRRP backup ingress

labroot@jtac-mx480-r2012-re0> monitor traffic interface ge-0/0/4.0 no-resolve layer2-headers | match vrrp
verbose output suppressed, use <detail> or <extensive> for full protocol decode
Address resolution is OFF.
Listening on ge-0/0/4.0, capture size 96 bytes
15:11:17.652102 Out 00:00:5e:00:01:01 > 01:00:5e:00:00:12, ethertype 802.1Q (0x8100), length 60: vlan 100, p 7, ethertype IPv4, 10.1.1.1 > 224.0.0.18: VRRPv2-advertisement 20: vrid=1 prio=120 authtype=none intvl=1
15:11:18.611356 Out 00:00:5e:00:01:01 > 01:00:5e:00:00:12, ethertype 802.1Q (0x8100), length 60: vlan 100, p 7, ethertype IPv4, 10.1.1.1 > 224.0.0.18: VRRPv2-advertisement 20: vrid=1 prio=120 authtype=none intvl=1

<<< From the above output, you can see that the VRRP advertisement packet is going out from the VRRP primary device.

It is expected behavior that the egress filter does not count egress VRRP packets because the packets are injected into the Packet Forwarding Engine (PFE) with a layer2 header and the PFE does not need to do anything with it. Therefore, the egress filter on the L3 interface will not be able to capture it.

On the other hand, the ingress VRRP packets are injected into the VRRP backup PFE with a layer3 header, which the PFE will be able to filter.

Use the show vrrp extensive command to check the real-time VRRP packets as shown below:

labroot@jtac-mx480-r2012-re0> show vrrp extensive logical-system r1 | grep "Advertisement sent"
  Interface VRRP PDU statistics
    Advertisement sent                       :1279802  
    Advertisement sent                       :1279802 <<<VRRP egress packets counter in the VRRP primary chassis</span>

labroot@jtac-mx480-r2012-re0> show vrrp extensive logical-system r3 | match "Advertisement received "
    Advertisement received                   :1279847  
    Advertisement received                   :1279847  <<<VRRP ingress packets counter in the VRRP backup chassis</span>