Link Aggregation Control Protocol (LACP, IEEE 802.3ad)
Link Aggregation Control Protocol (LACP) is a layer 2 control protocol that can be used to automatically detect, configure and manage, as one logical link, multiple physical links between two adjacent LACP enabled devices.
After at least two years of development LACP was formally published as IEEE Std 802.3ad-2000.
XXX - Check on dependencies -- (FWIW: LACP support is implemented within the "slow protocols" dissector).
XXX - Add example traffic here (as plain text or Wireshark screenshot).
The LACP protocol appears to be at least partially supported.
XXX - Without access to the formal IEEE spec, it hard to know how complete the current dissector is.
Example capture file
A complete list of LACP display filter fields can be found in the display filter reference
LACP support is implemented within the "Slow Protocols" dissector. The following presence filter will select LACP as well as other the other "Slow Protocols":
While there currently is no specific "lacp" presence filter, the following filter appears to successfully extract just frames containing lacp:
Capture frames containing lacp:
ether proto 0x8809
Details on obtaining the formal LACP specification (which, unfortunately, is not free) is available at:
IEEE Std 802.3ad-2000 Amendment to carrier sense multiple access with collision detection (CSMA/CD) access method and physical layer specifications-aggregation of multiple link segments
Included below are some links with potentially useful information regarding LACP and/or link aggregation:
How To - Configure, Verify, and Debug Link Aggregation Control Protocol (LACP) from Allied Telesyn
Link Aggregation Control Protocol (LACP) / 802.3ad from cisco.com
Merlink (Link Aggregation) from Embedded Solution Partners
Link Aggregation from linktionary.com
Link Aggregation Interoperability from dell.com
For some perspective on how the LACP came to be, see the following from ieee802.org:
The capture file "lacp1.pcap" referenced above was captured while connected to an end user port that originated from an Extreme Network's Summit300 series switch. While "link aggregation" was explicitly disabled on this port, the Extreme switch did have their "loop detect" feature enabled. Apparently Extreme has recognized that some of the features of LACP can be also used to prevent certain types of layer 2 loops.