Capture RIP v1 Updates in GNS3 Using Wireshark

Nerd Cafe | نرد کافه

What is RIP v1?

• A distance-vector routing protocol

• One of the oldest routing protocols

• Uses hop count as its routing metric

• Designed for small, simple networks

Metric & Limits

• Metric used: Hop Count

• Maximum hop count = 15

• 16 hops = unreachable (infinity)

• Not suitable for large networks because of this limit

Routing Updates

• Sends full routing table updates

• Update interval: every 30 seconds

• Uses broadcast (255.255.255.255)

• Can cause high bandwidth usage

Addressing & Classfulness

• Classful routing protocol

• Does NOT support VLSM (Variable Length Subnet Mask)

• Does NOT include subnet mask in updates

• Assumes default class A, B, or C networks

Security

• No authentication

• Routing updates are not encrypted

• Vulnerable to routing attacks or misconfigurations

Performance

• Slow convergence

• Network changes take time to propagate

• Not ideal for networks with frequent topology changes

Administrative Details

• Administrative Distance (AD): 120

• Uses UDP port 520

Advantages

• Very easy to configure

• Simple to understand

• Low CPU and memory usage

Disadvantages

• No VLSM support

• No authentication

• Slow convergence

• Limited scalability

• High broadcast traffic

RIP v1 vs RIP v2 (Quick Tip)

• RIP v1 → Classful, insecure

• RIP v2 → Classless, supports VLSM & authentication

Lab Objective

• Configure RIP version 1 on two Cisco routers (R1 and R2)

• Enable RIP to advertise connected networks over a serial link

• PCs (VPCS) obtain static IPs on LAN segments

• Verify RIP route exchange and convergence

• Capture and analyze RIPv1 broadcast updates using Wireshark

Network Topology

Device	Interface	IP
R1	FastEthernet0/0	192.168.1.1 /24
R1	Serial3/0	10.0.0.1 /8
R2	FastEthernet0/0	192.168.2.1 /24
R2	Serial3/0	10.0.0.2 /8
PC1	e0	192.168.1.10 /24 (GW 192.168.1.1)
PC2	e0	192.168.2.100 /24 (GW 192.168.2.1)

STEP 1: Configure IP Addresses on PCs (VPCS)

PC1 console:

PC1> ip 192.168.1.10 255.255.255.0 192.168.1.1
PC1> save

PC2 console:

PC2> ip 192.168.2.100 255.255.255.0 192.168.2.1
PC2> save

Verify:

PC1> ping 192.168.1.1     ← should succeed
PC2> ping 192.168.2.1     ← should succeed

Cross-ping (PC1 → PC2) will fail until RIP is configured.

STEP 2: Configure R1 Interfaces & RIP

R1> enable
R1# configure terminal
R1(config)# interface FastEthernet0/0
R1(config-if)# ip address 192.168.1.1 255.255.255.0
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# interface Serial3/0
R1(config-if)# ip address 10.0.0.1 255.0.0.0
R1(config-if)# no shutdown
R1(config-if)# exit
R1(config)# router rip
R1(config-router)# version 1
R1(config-router)# network 192.168.1.0
R1(config-router)# network 10.0.0.0
R1(config-router)# exit
R1(config)# exit
R1# write memory

STEP 3: Configure R2 Interfaces & RIP

R2> enable
R2# configure terminal
R2(config)# interface FastEthernet0/0
R2(config-if)# ip address 192.168.2.1 255.255.255.0
R2(config-if)# no shutdown
R2(config-if)# exit
R2(config)# interface Serial3/0
R2(config-if)# ip address 10.0.0.2 255.0.0.0
R2(config-if)# no shutdown
R2(config-if)# exit
R2(config)# router rip
R2(config-router)# version 1
R2(config-router)# network 192.168.2.0
R2(config-router)# network 10.0.0.0
R2(config-router)# exit
R2(config)# exit
R2# write memory

Test end-to-end:

PC1> ping 192.168.2.100     ← should now succeed
PC2> ping 192.168.1.10      ← should now succeed

STEP 5: Capture RIP Traffic with Wireshark

• In GNS3, right-click the serial link between R1 and R2 → Start capture

• Wireshark opens → start capturing

• Wait 30–60 seconds (RIP sends updates every 30s)

• Apply display filter:

rip

or

udp.port == 520

• Observe RIP Response packets (matches your screenshot):

  • Command: Response (2)

  • Version: RIP version 1

  • Source: 10.0.0.1 or 10.0.0.2

  • Destination: 255.255.255.255 (broadcast)

  • UDP src/dst port: 520

  • Advertised routes: e.g. 192.168.2.0 Metric: 1

• Example packet detail:

Routing Information Protocol
    Command: Response (2)
    Version: RIPv1 (1)
    IP Address: 192.168.2.0
    Metric: 1

💖 Support Our Work

If you find this post helpful and would like to support my work, you can send a donation via TRC-20 (USDT). Your contributions help us keep creating and sharing more valuable content.

TRC-20 Address: TAAVVf9ZxUpbyvTa6Gd5SGPmctBdy4PQwf

Thank you for your generosity! 🙏

Keywords

RIP, RIPv1, Routing Information Protocol, GNS3, Wireshark, RIP updates, broadcast, version 1, classful routing, hop count, network command, router rip, UDP 520, response packet, metric 1, serial link, VPCS, dynamic routing, route table, convergence, nerd cafe , نرد کافه

Channel Overview

🌐 Website: www.nerd-cafe.ir

📺 YouTube: @nerd-cafe

🎥 Aparat: nerd_cafe

📌 Pinterest: nerd_cafe

📱 Telegram: @nerd_cafe

📝 Blog: Nerd Café on Virgool

💻 GitHub: nerd-cafe