On network level you may want to listen on multicast broadcast to catch the Keepalived servers talking to each other. Example (found on https://www.cyberciti.biz/faq/linux-unix-verify-keepalived-working-or-not/):
root@linux:~# tcpdump -vvv -n -i eth0 host 224.0.0.18
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
11:19:43.530933 IP (tos 0xc0, ttl 255, id 58763, offset 0, flags [none], proto VRRP (112), length 40)
10.10.10.135 > 224.0.0.18: vrrp 10.10.10.135 > 224.0.0.18: VRRPv2, Advertisement, vrid 134, prio 111, authtype none, intvl 1s, length 20, addrs: 10.10.10.134
11:19:43.530941 IP (tos 0xc0, ttl 255, id 58763, offset 0, flags [none], proto VRRP (112), length 40)
10.10.10.135 > 224.0.0.18: vrrp 10.10.10.135 > 224.0.0.18: VRRPv2, Advertisement, vrid 134, prio 111, authtype none, intvl 1s, length 20, addrs: 10.10.10.134
11:19:43.530968 IP (tos 0xc0, ttl 255, id 58763, offset 0, flags [none], proto VRRP (112), length 40)
10.10.10.135 > 224.0.0.18: vrrp 10.10.10.135 > 224.0.0.18: VRRPv2, Advertisement, vrid 134, prio 111, authtype none, intvl 1s, length 20, addrs: 10.10.10.134
11:19:43.530972 IP (tos 0xc0, ttl 255, id 58763, offset 0, flags [none], proto VRRP (112), length 40)
10.10.10.135 > 224.0.0.18: vrrp 10.10.10.135 > 224.0.0.18: VRRPv2, Advertisement, vrid 134, prio 111, authtype none, intvl 1s, length 20, addrs: 10.10.10.134
This way you can find the virtual router id (vrid
) and the corresponding KeepaliveD servers (10.10.10.134
and 10.10.10.135
in this example).
But this is not a bullet-proof way to detect all Keepalived installations/virtual routers. Keepalived can also communicate on unicast (direct ip<->ip) without broadcasting into the network. But if you only use multicast broadcasting of the vrid then you should be able to find and identify the Keepalived servers and the used virtual router id's from a network point of view.
If you use a local monitoring agent/daemon or central configuration system, you can also parse the /etc/keepalived/keepalived.conf file for the virtual_router_id
option.