The LLT protocol is used for communication between servers running the Veritas Cluster Server (VCS) software.
The LLT dissector is partially functional as it only understands heartbeat frames that are broadcast by each node. The packets are standard Ethernet II frames with EtherType 0xCAFE. There is no known public reference for the protocol format. The fields that are currently understood in the heartbeat frames are the cluster number, message type (heartbeat), node id, sequence number and message time (ticks since reboot). The LLT protocol also uses messages directly between servers that are not dissected at this time.
The LLT frames use ethertype 0xCAFE by default. Some installations may have changed this to another value. A second value can be specified in the LLT preferences dialog of Wireshark. If a second value is specified, the default value of 0xCAFE will still be understood.
A complete list of LLT display filter fields can be found in the display filter reference
Show only LLT based traffic:
You cannot directly filter LLT protocols while capturing. However, you can filter on the ethertype:
Capture only the LLT traffic over the default ethertype (0xCAFE):
ether proto 0xCAFE
Veritas Tech Talk - document describing the Veritas Cluster Server (VCS), which uses LLT for communication between nodes.
LLT FAQ - Veritas Frequently Asked Questions about Low Latency Transport
Imported from https://wiki.wireshark.org/LLT on 2020-08-11 23:16:04 UTC