{"id":1266,"date":"2012-04-30T10:12:26","date_gmt":"2012-04-30T09:12:26","guid":{"rendered":"http:\/\/mccltd.net\/blog\/?p=1266"},"modified":"2012-08-16T14:19:27","modified_gmt":"2012-08-16T13:19:27","slug":"wccp-protocol-plus-wireshark-capture","status":"publish","type":"post","link":"http:\/\/darenmatthews.com\/blog\/?p=1266","title":{"rendered":"WCCP Protocol plus Wireshark Capture"},"content":{"rendered":"
\"CloudShark-Logo\"<\/a>

WCCP<\/p><\/div>\n

Refer to this Wireshark Capture. OR: view it now via Cloudshark\u00a0<\/strong>
\n<\/a><\/strong><\/p>\n

Alternatively, Download:<\/strong> WCCPv2.pcap<\/a> and continue reading..<\/p>\n

<\/a>\"WCCPv2\"<\/a><\/p>\n

Registration<\/strong>:
\nAccelerator or Engine is a WCCP client
\nRegisters WCCP services (0-255) with \u201cHere I Am\u201d if application is operational
\nRegistration announces WCCP client on service group, provides availability notification, requests interesting traffic
\nTransmits \u201cHere I Am\u201d every 10 seconds
\nLead WCCP client (lowest IP address) instructs routers on protocol\/port, assignment, forwarding, and return methods
\nRouter is a WCCP server
\nAccepts service group registration (0-255)
\nAcknowledges \u201cHere I Am\u201d with \u201cI See You\u201d
\nWaits 30 (3×10) seconds before declaring engine failed
\nAnnounce engines to other engines
\nRouter id is highest interface IP or highest loopback IP if one exists
\nRedirects traffic to engine<\/p>\n

Assignment<\/strong>: (Note, see this post “WCCP Load Distribution (Hash and Mask)<\/a>” to understand how this works.
\nSelects an engine in the cluster
\nHash 256 buckets
\nMask 128 buckets represented by 7 bit mask of the source or destination IP\/Port<\/p>\n

Redirect from Router to Cache Engine<\/strong>:
\nRedirect list allows router to permit\/deny traffic to intercept
\nTwo methods of redirection:
\nWCCP L2: Local subnet only, little overhead. Rewrites packet MAC address to that of the local Engine
\nWCCP GRE: Any IP-Subnet, more overhead. Creates tunnel from router to local or remote Engine.<\/p>\n

Return from Cache Engine to Router<\/strong>:
\nWCCP GRE return (the IP headers are encapsulated usuing transport-mode, adding GRE headers.\u00a0 This is used when the targets are on different subnets to the cache engine
\nWCCP L2 return
\nEngine can optionally return traffic any other way including routing<\/p>\n","protected":false},"excerpt":{"rendered":"

Refer to this Wireshark Capture. OR: view it now via Cloudshark\u00a0 Alternatively, Download: WCCPv2.pcap and continue reading..<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[53],"tags":[46,37],"_links":{"self":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1266"}],"collection":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1266"}],"version-history":[{"count":16,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1266\/revisions"}],"predecessor-version":[{"id":1626,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1266\/revisions\/1626"}],"wp:attachment":[{"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1266"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1266"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/darenmatthews.com\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1266"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}