eigrp

Overview ¶

Package eigrp decodes EIGRP (Enhanced Interior Gateway Routing Protocol) packets per RFC 7868 (informational; Cisco proprietary until 2016). EIGRP uses IP protocol number 88 — it runs directly over IP, not TCP or UDP. Multicast to 224.0.0.10 (all EIGRP routers); unicast for targeted messages. Runs on every Cisco enterprise campus / WAN deployment; common in enterprise data-centre access-layer and branch-office router configurations.

EIGRP is a **high-value enterprise routing target**. Unlike OSPF (which requires a DR election and per-area database synchronization before injecting routes), EIGRP authentication is OFF by default — any device that sends a Hello with the correct Autonomous System number immediately becomes an EIGRP neighbour and can inject arbitrary routes. Shodan and passive-BGP monitoring regularly surface enterprise routers running unauthenticated EIGRP toward untrusted segments.

The wire format leaks:

• **Autonomous System number** — the primary trust boundary. EIGRP neighbours must share the same AS number. Knowing the AS number from a captured Hello allows an attacker to form a neighbour relationship and inject routes, enabling traffic interception (MITM) or black-hole attacks, without needing any authentication material.

• **K-values (metric weights)** — K1 (bandwidth), K2 (load), K3 (delay), K4 (reliability), K5 (MTU weight). All neighbours must agree on K-values to form adjacency. K1=1 K2=0 K3=1 K4=0 K5=0 is the classic default. Non-default K-values fingerprint IOS version or non-standard policy.

• **Hold time** — how long before the neighbour is declared dead. Short hold times signal fast-convergence tuning.

• **Software version** — IOS major.minor and EIGRP major.minor, surfaced in the Software Version TLV (0x0004) of Hello packets. Discloses exact IOS release for vulnerability matching.

• **Internal route topology** — Internal Route TLVs (0x0102) in Update packets expose next_hop, delay, bandwidth, prefix_length, and destination subnet. These reveal the complete internal network topology.

• **External route redistribution** — External Route TLVs (0x0103) expose redistribution sources (OSPF, BGP, static, connected) with their originating router and AS. Reveals multi-protocol topology and BGP peering structure.

• **Authentication type** — the Auth TLV (0x0002) discloses whether MD5 (type 2) or SHA-256 named-mode (type 3) auth is in use. MD5 EIGRP authentication is offline-crackable via hashcat. SHA-256 named-mode (IOS 15.1+) is the modern secure option but is less widely deployed. No Auth TLV = NO AUTHENTICATION — neighbour spoofing trivial.

• **Flags** — the Init flag marks the first Hello in a new neighbour relationship; End-of-Table marks the last Update packet; Restart and Conditional Receive support graceful-restart and reliable multicast.

Wrap-vs-native judgement

Native. RFC 7868 is publicly available. The EIGRP wire format is a
tight 20-byte binary header followed by TLV entries. No crypto at the
parse layer (authentication TLV content is opaque auth data, not
decryptable payload). Pure offline parser.

What this package covers

• **20-byte EIGRP header**: version, opcode + name, flags (init / conditional_receive / restart / end_of_table), sequence, acknowledge, virtual_router_id, autonomous_system.

• **7-entry opcode name table**: 1 Update, 3 Query, 4 Reply, 5 Hello, 6 IPX-SAP (legacy), 10 SIA-Query, 11 SIA-Reply.

• **TLV walker**: type (2 BE) + length (2 BE) + value[length-4] for all TLVs present; surfaces tlv_count and tlv_types list.

• **Parameters TLV (0x0001)**: K1–K5 metric weights + hold_time.

• **Auth TLV (0x0002)**: auth_type with name (MD5 / SHA-256), has_auth.

• **Software Version TLV (0x0004)**: IOS major.minor + EIGRP major.minor.

• **Internal Route TLV (0x0102)**: next_hop (dotted-quad), delay, bandwidth, prefix_length, destination (dotted-quad). First route only.

• **Classification flags**: is_hello, is_update, is_query.

What this package does NOT cover (deliberately out of scope)

• **External Route TLVs (0x0103)**: full external route body (originating router + AS + external metric + protocol ID + flags + destination).

• **IPv6 route TLVs (0x0402, 0x0403)**: next-gen AFI-based route encoding.

• **Multi-Protocol TLVs (0x0602)**: AFI-based multi-topology routes.

• **Sequence TLV (0x0003)**: reliable-multicast peer sequence list.

• **Next Multicast Sequence TLV (0x0005)**: pending multicast delivery.

• **Stub Routing TLV (0x0006)**: stub-mode capability advertising.

• **Checksum verification**: header checksum field is decoded but not validated.

• **Authentication verification**: auth_data bytes are never surfaced; only auth_type is decoded (privacy-preserving, length only).

• **IP framing**: feed bytes after IPv4 header strip — EIGRP rides IP protocol 88 with no UDP/TCP wrapper.