Veritas Low Latency Transport (LLT)

The LLT protocol is used for communication between servers running the Veritas Cluster Server (VCS) software.

Example traffic



The LLT dissector is partially functional as it only understands heartbeat frames that are broadcast by each node. The packets are standard Ethernet II frames with EtherType 0xCAFE. There is no known public reference for the protocol format. The fields that are currently understood in the heartbeat frames are the cluster number, message type (heartbeat), node id, sequence number and message time (ticks since reboot). The LLT protocol also uses messages directly between servers that are not dissected at this time.

Preference Settings

The LLT frames use ethertype 0xCAFE by default. Some installations may have changed this to another value. A second value can be specified in the LLT preferences dialog of Wireshark. If a second value is specified, the default value of 0xCAFE will still be understood.

Example capture file

Display Filter

A complete list of LLT display filter fields can be found in the display filter reference

Show only LLT based traffic:


Capture Filter

You cannot directly filter LLT protocols while capturing. However, you can filter on the ethertype:

Capture only the LLT traffic over the default ethertype (0xCAFE):

ether proto 0xCAFE 

External links


Imported from https://wiki.wireshark.org/LLT on 2020-08-11 23:16:04 UTC