What do Cluster Heartbeat packets look like?

  • 10071158
  • NOVL79914
  • 17-May-2002
  • 20-Mar-2003

Goal

What do Cluster Heartbeat packets look like?

Fact

Novell NetWare Cluster Services 1.01

Note

Note that the packet depicted is from NCS 1.01 on NetWare 5.1 . On NCS 1.6 on NetWare 6 the broadcast is to address 0.0.0.0 , not 255.255.255.255 , to restrict it to the subnet.

Fix

Clustering Heartbeat packets use IP protocol 224, 0xE0 in hex.

Here is the structure of a Clustering Heartbeat packet;
 ETHERNET: ETYPE = 0x0800 : Protocol = IP:  DOD Internet Protocol
   + ETHERNET: Destination address : FFFFFFFFFFFF
   + ETHERNET: Source address : 00606D937A3A
     ETHERNET: Frame Length : 90 (0x005A)
     ETHERNET: Ethernet Type : 0x0800 (IP:  DOD Internet Protocol)
     ETHERNET: Ethernet Data: Number of data bytes remaining = 76 (0x004C)
 IP: ID = 0x137; Proto = 0xE0; Len: 76
     IP: Version = 4 (0x4)
     IP: Header Length = 20 (0x14)
     IP: Precedence = Routine
     IP: Type of Service = Normal Service
     IP: Total Length = 76 (0x4C)
     IP: Identification = 311 (0x137)
     IP: Flags Summary = 0 (0x0)
     IP: Fragment Offset = 0 (0x0) bytes
     IP: Time to Live = 128 (0x80)
     IP: Protocol = 0xE0
     IP: Checksum = 0x8495
     IP: Source Address = 155.126.24.136
     IP: Destination Address = 255.255.255.255
     IP: Data: Number of data bytes remaining = 56 (0x0038)