Listen before you claim: adding a security gateway to a ship's network without an outage
A shipboard security gateway must not take the router's address until it knows the router can take it back. That means hearing VRRP without speaking it. The receive path drops those packets twice before a firewall rule can see them. Here is where to listen instead, with no new privileges.