# CARP analyse in Wireshark



## aXi (Jun 27, 2016)

Hello,

Having some trouble with CARP on vmware ESXi I made network carptures with tcpdump. Here is the advertisement Wireshark interpert as VRRP:



 

My configuration in rc.conf is:

```
ifconfig_em0="inet 10.1.25.197 netmask 255.255.0.0"
ifconfig_em0_alias0="vhid 25 pass ToRTHYSTRac alias 10.1.25.198/32 advskew 200"
defaultrouter="10.1.1.1"
```
Three questions about that capture: Why there are 7 various IP Address and not 10.1.25.198? Why there is no authentication? Would the host receive some response?

Regards,
aXi


----------



## kpa (Jun 27, 2016)

Could it be that CARP is slightly different from VRRP and the packet contents will show non-sense if interpreted as VRRP?


----------



## SirDice (Jun 27, 2016)

CARP != VRRP.


----------



## aXi (Jun 27, 2016)

Ok, thanks for that.


----------

