74. First-hop redundancy, multicast, and MPLS/VRF in brief

Three topics you will meet, compressed to what you need to recognise them.

74.1 First-hop redundancy (VRRP / HSRP / GLBP)

The problem: hosts have one default gateway (Ch. 13). If that router dies, everything on the subnet is isolated — even if a second router is sitting right there.

The solution: two or more routers share a virtual IP and virtual MAC. Hosts point at the virtual IP and never know which physical router is answering.

   Router A (Master, priority 110)  \
                                      >--  VIP 192.168.1.1, VMAC 00:00:5e:00:01:XX
   Router B (Backup, priority 100)  /

   Hosts:  default gateway 192.168.1.1  (the VIP)

   A sends VRRP advertisements (multicast 224.0.0.18, IP protocol 112)
   every ~1 s. If B stops hearing them for ~3 s, B takes over the VIP and
   VMAC, and sends a gratuitous ARP so switches relearn the port.

Practicalities: preemption decides whether the higher-priority router takes back over when it returns (usually yes, with a delay so it can rebuild routing first). Interface tracking lowers priority if the uplink fails, so you don't fail over to a router that can't reach anything. In modern data centres, anycast gateways on every leaf switch (with EVPN) are replacing VRRP.

74.2 Multicast

The problem: send one stream to 500 receivers without sending 500 copies.

UNICAST     500 copies leave the server            (bandwidth = 500x)
BROADCAST   everyone gets it, wanted or not        (only works on one LAN)
MULTICAST   ONE copy per LINK; routers replicate only where receivers exist

Addresses: 224.0.0.0/4 (IPv4), ff00::/8 (IPv6). Well-known ones you'll see: 224.0.0.1 (all hosts), 224.0.0.2 (all routers), 224.0.0.5/6 (OSPF), 224.0.0.18 (VRRP), 224.0.0.251 (mDNS).

Two protocols do the work:

PIM modes: PIM-SM (sparse mode — receivers are few and scattered; uses a Rendezvous Point to bootstrap, then switches to a shortest-path tree), PIM-SSM (source-specific; no RP needed, simplest and preferred for one-to-many like IPTV), PIM-DM (dense mode — flood and prune; obsolete).

On switches, IGMP snooping is essential: without it, a switch treats multicast as broadcast and floods every port, defeating the point.

Where you'll actually meet multicast: IPTV and video distribution, financial market data feeds, mDNS/Bonjour service discovery, routing protocols themselves, and PTP time sync. It is largely absent from the public internet and from most cloud providers (AWS supports it only within Transit Gateway multicast domains) — it lives in enterprise and provider networks.

74.3 MPLS and VRFs

MPLS (Multiprotocol Label Switching) forwards on a short label instead of doing a longest-prefix IP lookup.

   Ingress router (LER):  push a LABEL onto the packet
   Core routers (LSR):    swap label -> label, forward   (fast, no IP lookup)
   Egress router (LER):   pop the label, forward as normal IP

   Header sits between L2 and L3 -- hence "layer 2.5"
   [ Ethernet | MPLS label(s) | IP | TCP | data ]

Labels are distributed by LDP (simple) or RSVP-TE / SR (traffic engineering). Modern networks increasingly use Segment Routing (SR-MPLS or SRv6), which encodes the path as a stack of segments in the packet and removes the need for a separate label-distribution protocol and per-flow state.

Why it exists (the original "faster than IP lookup" reason is obsolete — modern hardware does IP lookups at line rate):

1. Traffic engineering — steer traffic along a chosen path, not just the IGP shortest one.
2. Fast reroute (FRR) — pre-computed backup paths, sub-50 ms failover.
3. VPNs — the dominant use today.

VRF (Virtual Routing and Forwarding) is the related idea: multiple independent routing tables in one router.

   VRF "customer-A"   10.0.0.0/8 -> ...
   VRF "customer-B"   10.0.0.0/8 -> ...     <-- same prefix, different table,
   VRF "management"   ...                        no conflict

MPLS L3VPN combines them: each customer gets a VRF, and MP-BGP carries their routes across the provider core, tagged with a route distinguisher (to keep overlapping prefixes unique) and route targets (to control which VRFs import which routes). This is how a carrier sells "private WAN" to thousands of customers over one shared network.

EVPN is the modern successor for data centres: BGP-based control plane over a VXLAN data plane (Ch. 56), providing L2 and L3 multi-tenancy without the legacy flood-and-learn behaviour.

On Linux, VRFs are real and usable:

sudo ip link add vrf-red type vrf table 100
sudo ip link set vrf-red up
sudo ip link set eth1 master vrf-red
sudo ip route add default via 10.1.1.1 table 100
ip route show vrf vrf-red

74.4 Real-world example

A hospital ran patient monitoring over multicast and lost feeds intermittently on one floor. The floor's access switch had been replaced with a model where IGMP snooping was disabled by default, so multicast flooded every port — saturating the 1 Gbit/s uplink shared with everything else, and causing drops that looked like random monitor failures. Enabling snooping (and configuring an IGMP querier, since there was no multicast router on that VLAN) resolved it. Multicast without snooping is broadcast.

Try it yourself

# see multicast groups your machine has joined
ip maddr show
netstat -gn 2>/dev/null || ip -4 maddr

# watch IGMP and multicast on the wire
sudo tcpdump -i any -n 'igmp or (ip multicast)'

# mDNS is multicast you already run
sudo tcpdump -i any -n 'udp port 5353' -c 10
avahi-browse -a 2>/dev/null | head        # Linux
dns-sd -B _services._dns-sd._udp          # macOS

# VRF experiment (Linux, needs root)
sudo ip link add vrf-test type vrf table 200 && sudo ip link set vrf-test up
ip -br link show type vrf
sudo ip link del vrf-test