EIGRP core concepts (interview-grade notes)

Working notes on the NetworkLessons EIGRP course, written in my own words. Protocol facts below are textbook-level general knowledge (No single source — RFC-less Cisco protocol; cross-check with Cisco docs when a number matters); lesson-specific details link to the course and were read 2026-10-03.

1. What EIGRP is

Cisco’s advanced distance-vector IGP. Historically proprietary, standardized-ish via RFC 7868 (informational). Key identifiers:

• Protocol number 88 directly over IP (no TCP/UDP header) — its own RTP (Reliable Transport Protocol) provides sequencing/ack, which is a classic “why no TCP?” interview point.
• Multicast 224.0.0.10 (IPv6 FF02::A) for hellos/updates on LANs.
• Runs as an autonomous-system process (router eigrp 1); two routers must share AS number to become neighbors (one of the six adjacency breakers).

Three tables: neighbor, topology, routing. The topology table holds all learned paths with FD/RD; only successors are installed.

2. Neighbor adjacency

Hellos every 5 s (60 s on multipoint/T1 rates), hold time 3× hello = 15/180 s. Hello/hold are per-interface and need not match between neighbors (unlike some protocols) — but a hold-time mismatch is still a classic misconfig symptom.

Adjacency requirements (six ways it breaks — troubleshooting lesson):

1. Uncommon subnet (primary addresses must share a subnet)
2. K-value mismatch
3. AS number mismatch
4. Passive-interface on the facing interface
5. Multicast filtered (ACL blocking 224.0.0.10) — or unicast-only setup without static neighbor
6. NBMA mapping (frame-relay frame-relay map ... broadcast missing)

3. Metrics

Classic 32-bit composite: metric = 256·(K1·BW + K3·BW/(256−load) + K2·BW·load + K5/K4+delay) — practically K1 (bandwidth) + K3 (delay), defaults K1=K3=1, K2=K4=K5=0, so metric = 256·(10⁷/BW_min + delay_sum/10). Lowest bandwidth along the path (not per-hop) + summed delay. K mismatch both changes calculation and blocks adjacency.

Wide metrics (named mode): 64-bit, separate throughput/latency fields so high-speed links are distinguishable (classic metric saturates above 1 Gbps — everything ≥1G looks equal).

4. DUAL — the interview centerpiece

• FD (feasible distance): my best metric to the destination.
• RD (reported distance): the neighbor’s metric to the destination.
• Feasibility condition: RD < FD → the neighbor is a feasible successor (loop-free by induction: anything a neighbor advertises that is “closer than I ever was” cannot route back through me).
• Successor = best path (installed). Feasible successor = precomputed loop-free backup — instant failover, no query.
• If no FS exists when the successor dies: route goes Active, router sends Query to neighbors (diffusing computation), waits for Replies. A neighbor without an answer forwards the query onward — this is distance-vector recursion and the reason query scope explodes.
• SIA (Stuck In Active): no reply within ~3 min → neighbor reset. Modern IOS sends SIA-Reply keepalives at 90 s to distinguish “thinking” from “dead”.
• Query scope control = stub routing (eigrp stub connected|static|summary|redistributed|receive-only, optional leak-map to leak specific prefixes): stub routers are never queried, so branch failovers don’t cascade SIA across the WAN.

5. Convergence tooling

• LFA Fast Reroute (fast-reroute): promote a feasible successor to backup precomputed in FIB, sub-50 ms repair — same idea as OSPF LFA/IP-FRR; ties into the low-latency book’s repair-path trade-offs (see [[../low-latency/00-book-guide]] lens: precomputation vs reaction).
• Graceful shutdown: Goodbye TLV lets neighbors clear the adjacency immediately instead of waiting out hold time.
• Unequal-cost load balancing: variance n installs paths with FD ≤ n·(best FD) if they also satisfy the feasibility condition; traffic-share balanced splits inversely to metric, min uses only min-delay paths.

6. Policy and scaling toolbox

distribute-list (ACL/prefix-list/route-map, in/out), prefix-list (ge/le matching), route-map filtering, ip summary-address eigrp per interface (+ leak-map for the exceptions), ip bandwidth-percent eigrp (default 50% — matters when you artificially set low bandwidth on multipoint links), passive-interface, static neighbor (unicast, disables multicast on that interface), eigrp router-id (needed for external route originator; collisions cause weirdness), auto-summary (legacy: classful boundaries break discontiguous networks — always disable), named mode (address-family with per-AF settings incl. SHA-256 auth).

Redistribution: external routes get AD 170, metric carries external info (router-id of originator, source protocol); with two redistribution points, path selection follows the lesson’s external path-selection case — seed metric defaults matter (5/5/5/1/1500-style defaults per source protocol).

7. Why fintech/trading networks historically like EIGRP (my mapping, Unverified as a general claim)

• Cisco-standardized shops: fastest convergence with least design effort (no area/LSDB planning like OSPF), stub + LFA for branch/edge, easy summarization knobs.
• Query-scope control (stub/SIA) is the main design risk — mirrors the multicast group’s failure-modes file: the protocol’s fast path is great, the failure mode is a flood.
• Real exchanges and modern DCs lean on OSPF/IS-IS/BGP, so EIGRP shows up more in firm internal networks and interview trivia than on exchange-facing links.

Self-check (answer before looking back)

1. State the feasibility condition and explain why it guarantees loop-freedom without a full topology view.
2. Why does losing a feasible successor never put a route into Active state?
3. Six reasons adjacency fails — name them and the command you’d check each with.
4. What problem does eigrp stub solve, and what does leak-map deliberately re-introduce?
5. Classic vs wide metrics: what breaks at 1 Gbps+, and where is wide metrics configured?
6. variance 3 with successor FD 100 and candidate path FD 280: installed or not, and what else must be true?
7. Why is EIGRP’s RTP a reason it can’t easily run “anywhere” OSPF does (link-type assumptions, multicast/unicast needs)?
8. SIA-Reply: what changed vs the old “reset after 3 minutes” behavior?

Open questions / to verify

• Exact modern default timers on Ethernet (course says 5/15; verify on IOS-XE 17.x) — Unverified
• SHA-256 only in named mode — confirm against Cisco config guide — Unverified
• Whether any public trading-firm postmortems implicate EIGRP query storms (search later; multicast/incidents.md has the multicast analogues)