EIGRP Packet Types

EIGRP (Protocol No. 88) runs on top of IP and hence is referred to as a Transport layer protocol.

The Application layer protocols such as BGP, Telnet, FTP etc, do not have any inbuilt reliability mechanism and therefore depend on TCP (Protocol No. 6) at Transport layer to maintain reliability.

EIGRP uses 5 packet types (Hello, Update, Query, Reply, ACK) for functioning. Each EIGRP Packet has a common header and some TLVs associated with it. Kindly refer EIGRP Packet Format for more details.

The EIGRP packets carrying routing information (i.e. Update, Query, and Reply) are sent reliably because they are not sent periodically, which means that a sequenc.e number is assigned to each reliable packet and an explicit acknowledgment is required for that sequence number.

EIGRP has its own reliability mechanism to acknowledge the receipt of its multiple types of packets and uses Reliable Transport Protocol (RTP) to deliver or exchange packets between the neighbors in guaranteed and ordered way.

RTP ensures that ongoing communication is maintained between neighboring routers. As such, a re-transmission list is maintained for each neighbor. This list indicates packets not yet acknowledged by a neighbor within the RTO(Round-Trip Timed Out). It is used to track all the reliable packets that were sent but not acknowledged.

Imp Note: If the RTO expires before an ACK packet is received, the EIGRP process transmits another copy of the reliable packet, up to a maximum of 16 times or until the hold time expires.

Following are five types of packets and details are shared in table below:

EIGRP Packet Types

Let's see some details of each packet using below topology.

EIGRP Packets

EIGRP Packet Types - Hello Packet

EIGRP Hello/Holdown timers/Intervals:
  • For the links with bandwidth greater than T1(1.544 Mbps) or more, for example, Ethernet, Fast-Ethernet, POS links, hello packets are sent every 5 seconds and hold down timer is 15 seconds.
  • For the links with bandwidth equal to or less than T1, hello timer is 60 seconds and default hold timer is 180 seconds.
Hello Packets have Acknowledgment number of 0. Both Hello and ACK Packets have Opcode 5.

Hello Packets are always sent to a destination multicast IP address reserved for EIGRP.  At Data Link layer, a specific EIGRP destination MAC address (01:00:5e:00:00:0a) is used as shown in figure below:

EIGRP Hello Message

Also note that default Hello and Hold down timer can be changed using interface configuration commands as given below:

R1(config-if)#ip hello-interval eigrp as-number seconds.
R1(config-if)#ip hold-time eigrp as-number seconds

EIGRP Packet Types - Update Packet

EIGRP Updates Packets are sent as multicast as well unicast as explained below:

EIGRP Updates Packets are sent multicast when a new route is discovered, a network goes unreachable or any routing change, for example, a metric change happens. To understand this, let's configure a new loopback interface Lo1 ( on R1 and advertise this subnet in EIGRP. We'll see that R1 will send an EIGRP Update of this subnet on multicast destination IP address  to its neighbor R2. Below is Wireshark capture of R1 sending an update to R2 on multicast address Update messages have OPCode of 1.

EIGRP Update - Multicast

EIGRP Update Packets are sent as  unicast to neighbors when EIGRP process is restarting. For example, if we reset the EIGRP process on R1 using "clear ip eigrp neighbor" command, R1 and R2 will send the Update Packet to each other as unicast messages on their physical interface IP addresses. R1's physical interface IP address is and R2's physical interface IP address is

R1#clear ip eigrp neighbors

Below is wireshark capture of R1 sending unicast update to R2.

EIGRP Update - Unicast

EIGRP Packet Types - Query Packet

When an EIGRP router doesn't have a feasible successor (FS) for a route, it sends Query Packet to its neighbors. This query Packet is sent as a multicast on a multicast address

If the router which has originated the Query Packet does not receive a response/Reply Packet from any of its neighbors, it re-sends the Query as a Unicast packet to the non-responsive neighbor(s). If no response is received in 16 attempts, the EIGRP neighbor relationship is reset with that neighbor.

Query Packets are sent reliably and neighbors reply with EIGRP ACK Packet as soon they receive the Query Packet to confirm the receipt. Query Packets have OPCode of 3.

EIGRP Packet Types - Reply Packet

Reply Packets are sent as unicast on physical interface IP address of the neighbor and are sent reliably, meaning that the neighbors reply with EIGRP ACK Packet as soon they receive the Reply Packet to confirm the receipt. Reply Packets have OPCode of 4.

EIGRP Packet Types - ACK Packet

EIGRP ACK Packets are sent unicast as an acknowledgement for receipt of Update, Query, and Reply Packets. EIGRP ACK Packets are Hello Packets with a non-zero Ack number.  Both Ack and Hello Packets have Opcode 5.


We can also see the flow of EIGRP messages by enabling debugging of EIGRP packets as shown below:

R1#debug eigrp packets
EIGRP Packet debugging is on

Besides the 5 packets types discussed in this article, EIGRP also sends a new kind of message named EIGRP Goodbye message which is designed to improve EIGRP network convergence and it uses Goodbye message to communicate this information to the neighbors. With graceful shutdown, a goodbye message is broadcast when an EIGRP routing process is shut down, to inform adjacent peers about the impending topology change. This feature allows supporting EIGRP peers to synchronize and recalculate neighbor relationships more efficiently than would occur if the peers discovered the topology change after the hold timer expired.Goodbye messages are sent in EIGRP Hello packets. EIGRP sends an interface goodbye message with all K values set to 255 when taking down all peers on an interface

Click Here for other useful EIGRP articles

Post a comment