First-hop redundancy: VRRP, HSRP, and the gateway that is a fiction

First-hop redundancy protocols such as VRRP and HSRP let several routers share one default gateway address and one virtual MAC address, so that hosts keep forwarding when the router behind that address fails. After reading, you can say what a host can and cannot do on its own, compute a VRRPv3 failover time from priority and interval, compare HSRP's defaults, recognise the usual failures and the attack surface, and find both protocols in a capture and in router output.

View as Markdown

An IPv4 host sends everything for other subnets to one address, its default gateway, so the router behind that address is a single point of failure. First-hop redundancy removes it from the network side. The Virtual Router Redundancy Protocol (VRRP), a standard of the Internet Engineering Task Force (), and Cisco's older Hot Standby Router Protocol (HSRP) let several routers share the gateway's IP address and a media access control (MAC) address, one router answering at a time. After reading, you can say what a host can do alone, compute a VRRP failover time, compare HSRP, and recognise and capture both.

What the host can do on its own

More than folklore says. (RFC) 1122, the host requirements of 1989, states that "The IP layer MUST support multiple default gateways" (RFC 1122, section 3.3.1.2) and that "The IP layer MUST be able to detect the failure of a 'next-hop' gateway that is listed in its route cache and to choose an alternate gateway" (section 3.3.1.4), switching to another default when one is known (section 3.3.1.5). It also admits that "Experience to date has not produced a complete algorithm which is totally satisfactory" (section 3.3.1.4).

Detection is left to each implementation, and a host given one gateway, by hand or by the Dynamic Host Configuration Protocol (), has nothing to switch to. Internet Control Message Protocol () Router Discovery advertises every 7 to 10 minutes by default, which its own RFC calls insufficient for detecting a dead first hop (RFC 1256, section 2). RFC 9568, the current VRRP standard, states the consequence: "Loss of the default router results in a catastrophic event, isolating all end-hosts that are unable to detect an available alternate path" (RFC 9568, section 1.3). First-hop redundancy fixes this without touching a host.

The virtual router

On a local area network (), RFC 9568 defines a Virtual Router as "An abstract object managed by VRRP that acts as a default router for hosts on a shared LAN" (RFC 9568, section 1.7). It has a Virtual Router Identifier (VRID) from 1 to 255 and a set of addresses; the Active Router forwards for it, the Backup Routers wait. A router whose real interface address is the virtual address is the address owner, and it is always Active when available (section 1.7). HSRP forbids that: its group address must differ from every real address on the LAN (RFC 2281, section 1).

RFC 9568 (April 2024) obsoletes RFC 5798 (March 2010), which obsoleted RFC 3768 (April 2004) (RFC 9568, Abstract), the successor of RFC 2338 (April 1998) (RFC 3768, section 13). It also renamed the forwarding router: "The term for the VRRP Router assuming forwarding responsibility has been changed to 'Active Router' to be consistent with IETF inclusive terminology" (section 1.1). Older RFCs and current implementations say Master.

RFC 2281 (March 1998), which describes HSRP, is Informational and specifies no standard (RFC 2281, Status of this Memo). Its section 2 cited US Patent 5,473,599 of 5 December 1995, but verified erratum 464 says that section "was mistakenly included in the document and is incorrect" (RFC 2281 errata).

Two addresses move, and the MAC is the point

Protocol	Virtual	Defined in
VRRP for IPv4	`00-00-5E-00-01-{VRID}`	RFC 9568, section 7.3
VRRP for IPv6	`00-00-5E-00-02-{VRID}`	RFC 9568, section 7.3
HSRP version 1	`00-00-0C-07-AC-XX`, XX the group number	RFC 2281, section 6.1
HSRP version 2	`0000.0C9F.F000` to `0000.0C9F.FFFF`	Cisco, Configuring HSRP

00-00-5E is the Organizationally Unique Identifier (OUI) of the Internet Assigned Numbers Authority (), and RFC 9542 assigns its 00-01 and 00-02 blocks to VRRP for IPv4 and IPv6 (RFC 9542, sections 1.3 and 2.1.3; IANA, IANA OUI Ethernet Numbers). The last octet is the VRID or group in hexadecimal: VRID 5 gives 00-00-5E-00-01-05, HSRP group 10 gives 00-00-0C-07-AC-0A.

Hosts resolve the gateway with the Address Resolution Protocol (), and the answer is the virtual MAC: "The Active Router MUST NOT respond with its physical MAC address in the ARP response. This allows the host to always use the same MAC address, regardless of the current Active Router" (RFC 9568, section 8.1.2). After a failover, nothing in a host's cache has changed.

What changes is the switch port behind the MAC. The Active Router sources its advertisements from the virtual MAC, because otherwise "the MAC address location is never learned, resulting in flooding of all packets sent to the Virtual Router" (section 2.4). On taking over, it broadcasts a for each virtual IPv4 address, or for IPv6 an unsolicited Neighbor Advertisement with the Override flag (section 6.4.2, as corrected by verified erratum 7949). Neighbours refresh under ARP's merge rule and switches relearn the port. HSRP's announcement is an ARP response instead (RFC 2281, section 5.6).

VRRPv3: the advertisement and the election

VRRP version 3 has one message, the ADVERTISEMENT, sent by the Active Router and carrying the VRID, priority, a 12-bit interval in centiseconds and the virtual addresses (RFC 9568, sections 5.1 and 5.2). The rules that decide who is Active:

Rule	Value	Source in RFC 9568
Owner's priority	255	section 5.2.4
Backup priority	1 to 254, default 100	section 5.2.4
Priority 0	the Active Router resigns; Backups take over after Skew_Time	section 5.2.4
Tie	higher primary address wins, unsigned comparison	section 6.4.3
Preempt_Mode	default True; the owner always preempts	section 6.1
Accept_Mode	default False: a non-owner does not accept packets for the virtual address, so a ping to it can fail	section 6.1

The timers, worked

The interval defaults to 100 centiseconds, one second (RFC 9568, section 5.2.7), configurable from 1 to 4095 under verified erratum 8301. A Backup declares the Active Router down with the formulas of section 6.1:

Skew_Time            = ((256 - Priority) * Active_Adver_Interval) / 256
Active_Down_Interval = (3 * Active_Adver_Interval) + Skew_Time

At the defaults, (256 - 100) x 100 / 256 is 15,600 over 256, a skew of 60.9375 centiseconds, so the Backup waits 360.9375 centiseconds, 3.6094 seconds:

Backup priority	Skew_Time	Active_Down_Interval
254	0.7812 cs	300.7812 cs (3.0078 s)
200	21.8750 cs	321.8750 cs (3.2188 s)
100 (default)	60.9375 cs	360.9375 cs (3.6094 s)
1	99.6094 cs	399.6094 cs (3.9961 s)

The skew lets the best Backup move first, and "faster convergence can be obtained by using a higher priority for the preferred Backup Router" (RFC 9568, section 8.3.2). Section 3 promises under 4 seconds by default and under 1/25 second when configured; the table's slowest Backup waits 3.9961 seconds, and at a 1-centisecond interval a priority-254 Backup waits 3.0078 centiseconds, about 30 milliseconds. The RFC sets no rounding rule; FRRouting (FRR) prints whole centiseconds, 210 ms of skew for priority 200 against an exact 21.875 centiseconds (FRRouting documentation, VRRP). The Python playground repeats the arithmetic.

HSRP: the same idea, other numbers

	VRRPv3	HSRP version 1
Transport	IP protocol 112 to 224.0.0.18 or ff02::12, Time to Live () 255	UDP 1985 to 224.0.0.2, TTL 1
Timers	1 s advertisements, down after 3.6094 s at priority 100	Hellotime 3 s, Holdtime 10 s
States	Initialize, Backup, Active	Initial, Learn, Listen, Speak, Standby, Active
Preemption	on by default	only if configured
ICMP redirects	may be used	MUST NOT be sent
Status	Proposed Standard	Informational

The HSRP column comes from RFC 2281 (RFC 2281, sections 5.1, 5.3 and 6.3), the VRRP column from RFC 9568, sections 5.1, 6.3 and 8.1.1. HSRP compares priorities like VRRP, the higher address breaking a tie (RFC 2281, section 5.1), and Cisco ships its defaults: "The default hello interval is 3 seconds. The default hold time is 10 seconds" (Cisco, command reference). A standby acts 10 seconds after the last Hello, 2.77 times VRRPv3's 3.61 seconds. Without standby preempt, Cisco says, a router "will not become the active router, even if its priority is higher than all other routers" (Cisco, Configuring HSRP). Version 2 adds groups 0 to 4095, the group 224.0.0.102 and millisecond timers, and does not interoperate with version 1 (Cisco, Configuring HSRP).

IPv6: the gateway is link-local

For IPv6 the virtual router's first address must be link-local, only the Active Router sends Router Advertisements for it, and Backups must carry the same advertisement options (RFC 9568, sections 5.2.9, 6.4.3 and 8.2.3), so hosts learn it the usual way. Hosts could fall back on Neighbor Unreachability Detection, but with Neighbor Discovery (ND) defaults "it can take a host more than 10 seconds to learn that a router is unreachable before it will switch to another default router", against about three seconds with VRRP (section 1.4). One trap: if two routers end up with the same link-local address, FRR warns "this can cause both routers to assume the Master role (very bad)" (FRRouting documentation, VRRP).

Tracking: the failure the protocol cannot see

Neither standard looks past the LAN. RFC 2281 assumes all routers have a consistent set of routes (RFC 2281, section 1), and VRRP's election reads priorities and advertisements only. A router whose uplink died keeps winning and forwards into whatever is left of its table.

Tracking, a feature found in no RFC, is the answer. Cisco tracks an interface's line protocol or a route's reachability, and "By default, the priority of the device is decreased by 10 if a tracked object goes down" (Cisco, Configuring HSRP); with no standby track there is none. keepalived's track_interface lowers priority by a weight (keepalived.conf(5)). Check the arithmetic: an active router at 110 that loses 10 ties a standby at 100, the higher address wins the tie, and that may be the broken router; an HSRP standby also needs preemption. Detecting a dead path fast is the job of Bidirectional Forwarding Detection (BFD).

How it fails

Two Active Routers. If advertisements stop crossing between the routers, each Backup times out and turns Active, and "having multiple Active Routers can cause as much disruption as no routers" (RFC 9568, section 9). Two routers configured as owner stay Active together (verified erratum 8298). Both send from one virtual MAC, so switches see it jump between ports.
Mismatched intervals. An Active Router slower than its Backups is unstable (RFC 9568, section 5.2.7). A zero interval times out every Backup at once, and the author of verified erratum 8301 reports "It causes mayhem (I have tried it)!" Cisco asks for the same timers on every HSRP router (Cisco, command reference).
Sub-second timers under load. Queueing delay longer than the interval promotes a Backup until the late advertisement demotes it, and "this process can repeat many times per second, causing a significant disruption of traffic" (RFC 9568, section 2.5); the remedy is priority for VRRP on egress queues.
Preemption flapping. A higher-priority router that keeps reloading takes the gateway back each time it returns. No RFC describes the cycle; vendors offer a delay, 0 seconds by default on Cisco (Cisco, command reference).
The MAC that does not move. standby use-bia makes HSRP use the router's burned-in address (BIA), and RFC 2281 says "This method of operation is strongly discouraged" (RFC 2281, section 6.1): the gateway's MAC changes at every failover, and hosts depend on the gratuitous ARP or on a cache timeout that RFC 1122 puts at about a minute (RFC 1122, section 2.3.2.1).
Asymmetric paths. VRRP may send redirects where the topology is not symmetric (RFC 9568, section 8.1.1); RFC 2281 forbids it for HSRP, because a redirect would reveal a router's own address (RFC 2281, section 6.3). When replies return through the other router, a device keeping per-connection state on one path sees half of each conversation.

The attack surface, and the defence

Early VRRP offered a text password or the IP Authentication Header (RFC 2338, section 5.3.6); RFC 3768 removed both (RFC 3768, section 13). RFC 9568 explains: "Operational experience and further analysis determined that these did not provide sufficient security to overcome the vulnerability of misconfigured secrets, causing multiple Active Routers to be elected" (RFC 9568, section 9). A node on the LAN that advertises a higher priority sends the real routers to Backup, and signing could not stop a node from simply acting as an Active Router itself. For HSRP, "The protocol is easily subverted by an active intruder on the LAN" (RFC 2281, section 7).

RFC 9568 calls these a subset of what any node on a LAN can already do (section 9). The built-in guard is TTL 255, which keeps out injection from other networks; HSRP relies on routers not forwarding 224.0.0.2 (RFC 2281, section 7). The defence RFC 9568 names is the access port: switches that filter ARP or ND from end-host ports could filter VRRP there too (RFC 9568, section 9).

How to see it

Capture filters (pcap-filter(7)):

vrrp                           abbreviation for: ip proto 112
ip6 proto 112                  VRRP over IPv6
udp port 1985                  HSRP
ether host 00:00:5e:00:01:05   frames to or from the virtual MAC of VRID 5

Wireshark's display filters are vrrp and hsrp (Wireshark, vrrp fields). An illustrative advertisement from documentation addresses, gateway 192.0.2.1, Active Router 192.0.2.2:

Field	Value	What it tells you
source	00:00:5e:00:01:05	the virtual MAC of VRID 5
IPv4 source	192.0.2.2	the Active Router's own address
Destination, TTL, protocol	224.0.0.18, 255, 112	VRRP, never forwarded
`vrrp.version`, `vrrp.type`	3, 1	a VRRPv3 ADVERTISEMENT
`vrrp.virt_rtr_id`	5	the VRID
`vrrp.prio`	100	default priority; 255 is the owner, 0 a resignation
`vrrp.short_adver_int`	100	centiseconds: one per second
`vrrp.ip_addr`	192.0.2.1	the virtual address

A failover shows a new sender behind the same source MAC and a gratuitous ARP. HSRP Hellos come from both active and standby; read hsrp.state, hsrp.priority, hsrp.hellotime, hsrp.holdtime and hsrp.virt_ip, or hsrp2.* for version 2 (Wireshark, hsrp fields).

FRR's show vrrp, in an excerpt of its documentation's example with alignment simplified (FRRouting documentation, VRRP):

Virtual MAC (v4)                    00:00:5e:00:01:05
Status (v4)                         Master
Priority                            200
Preempt Mode                        Yes
Master Advertisement Interval (v4)  1000 ms
Skew Time (v4)                      210 ms
Master Down Interval (v4)           3210 ms

keepalived's matching keywords are virtual_router_id, priority, advert_int (seconds), nopreempt and preempt_delay (keepalived.conf(5)). Cisco's commands, as its command reference prints them (Cisco, command reference):

standby version {1 | 2}
standby [group-number] preempt [delay {minimum | reload | sync} seconds]
standby track {object-number | interface-type interface-number [decrement priority-decrement]} [shutdown]
standby use-bia [scope interface]

The OUI lookup resolves 00:00:5E:00:01:05 to ", IANA Department", a unicast, universally administered address; it does not say VRRP, because the VRRP block is a sub-assignment inside IANA's OUI. The IPv6 Toolkit shows ff02::12 as link-local multicast, also without naming VRRP. When two routers disagree, the packet capture plan builder helps place captures on both sides.

What to remember

The gateway is a role: a VRID, its addresses and a well-known virtual MAC, held by whichever router is Active; the owner (priority 255) always wins.
Hosts must detect a dead gateway, but can switch only to one they know, and no detection algorithm was standardised.
The virtual MAC keeps every host's cache valid; the Active Router sources advertisements from it so that switches learn its port.
VRRPv3 declares the Active Router down after three intervals plus a skew: 3.6094 seconds at priority 100 and the default interval, under 4 seconds for any Backup; HSRP's 3 and 10 seconds are 2.77 times slower.
Preemption is on by default in VRRP and off in HSRP; neither sees a failed uplink unless vendor tracking lowers the priority enough.
VRRP dropped authentication because it cannot prevent a second Active Router; TTL 255 keeps attacks on the LAN and port filtering keeps them off end-host ports.
The current standard is RFC 9568 (April 2024), which says Active Router where older texts say Master; RFC 2281 is Informational.