CLARIFICATION - PING LOOPBACK OSI LAYERS

[maczen]

Quick question..

When I ping the loopback address of:
A) Cisco Device (icmp traffic actually sent on wire)
B) PC (No traffic on wire)
What layers of the OSI model are being tested?

Here is the reason that I ask...

https://cisco.hosted.jivesoftware.com/thread/4161?tstart=0

I have heard 1-3, 3-4, 1-7 etc.

I believe that the same layers are being tested regardless of whether or not the traffic crosses the wire but looking for someone to enlighten.. LoL Thanks

B Haines
CCNA R&S, ETA FOI

 

[maczen]

1. Sorry, said can not ping but meant can not capture ping traffic with or without the loopback adapter installed.. Was very tired from class plus study!

2. Tad, that is the logic that I was following with the exception that I considered the TCP/IP stack more of a layer 4 hence my (personal view) of a loopback ping testing 1-4 OSI. Perhaps this diagram can assist...

http://upload.wikimedia.org/wikiped...psulation.svg/350px-UDP_encapsulation.svg.png

Regardless, a session would not be established (5) although the TCP software was tested... Furthermore, no presentation (ASCII/EBCDIC/encryption etc. (6)) is occurring nor anything at the application layer!

I still feel that a regular ping would test 1-3 and a loopback 1-4 (due to the TCP stack test) but I have been wrong before.. once.. LoL J/K

This is becoming a very interesting topic and I am quite curious to see where it goes.. LoL So simple a topic such as an ICMP echo request yet so much controversy! LoL Please let me know what you guys think and thanks for your view Tad!

B Haines
CCNA R&S, ETA FOI

 

[maczen]

ok.. one more time.. LoL Can not capture loopback traffic on Vista with or without loopback adapter using WireShark!

OK.. I think that I have finally stumbled over that explanation enough.. LoL

B Haines
CCNA R&S, ETA FOI

 

[burtsbees]

Tad---I don't think Microcrap is talking BOUT THE tcp/ip suite/model---they're talking about the tcp/ip stack, which actually consists of layers 1-3 (there is no layer 4 connectivity in a ping). This is the misnomer I was talking about.
Billy..."...although the TCP software was tested..."
What software?
Also Tad---I thought that Cisco put ARP at layer 2...I remember that frame relay is L2, and I thought Cisco also put I-ARP at layer 2...I will have to see what Wireshark says...

Burt

 

[maczen]

Let me further confuse and complicate matters.. This would suggest that either layer 3 alone (OSI) is tested or 3-7! LoL

*********************************
Loopback Addresses

Normally, when a TCP/IP application wants to send information, that information travels down the protocol layers to IP where it is encapsulated in an IP datagram. That datagram then passes down to the data link layer of the device's physical network for transmission to the next hop, on the way to the IP destination.

However, one special range of addresses is set aside for loopback functionality. This is the range 127.0.0.0 to 127.255.255.255. IP datagrams sent by a host to a 127.x.x.x loopback address are not passed down to the data link layer for transmission. Instead, they “loop back” to the source device at the IP level. In essence, this represents a “short-circuiting” of the normal protocol stack; data is sent by a device's layer three IP implementation and then immediately received by it.

The purpose of the loopback range is testing of the TCP/IP protocol implementation on a host. Since the lower layers are short-circuited, sending to a loopback address allows the higher layers (IP and above) to be effectively tested without the chance of problems at the lower layers manifesting themselves. 127.0.0.1 is the address most commonly used for testing purposes.
*******************************

http://www.tcpipguide.com/free/t_IPReservedPrivateandLoopbackAddresses.htm

B Haines
CCNA R&S, ETA FOI

 

[burtsbees]

Normally, when a TCP/IP application wants to send information, that information travels down the protocol layers to IP where it is encapsulated in an IP datagram."

Yes. But that is not ICMP. ICMP, even the loopback, tests layers 1-3. Layer 1 is self-explanatory---for ANY communication to take place, whether it's an internal bus on a wire or solder run or along an external wire, there must be physical connectivity. In order to ping an IP address, that station must look up the ARP cache (L2). Then the IP address of course is layer 3. Now in a loopback, I am not sure where L2 is, but the datagram is in fact built, so I believe it MUST go through L2 to have a L3.
Now I challenge anyone from tcpipguide or MicroCrap to show where the other layers are tested (specifically, not to say "the higher layer, ip and above, are tested").

Burnt Butter

 

[lerdalt]

I'm with Burt, but I also never really trust Microsoft when it comes to true networking fundamentals.

Burt, you do have me thinking though, what is the L2 address for the loopback. Or is there one. I tried checking the arp table on my local windows box, and there is nothing for the loopback address. Popped over to my backtrack2 virtual machine, and ifconfig shows no HWAddr listed. My favorite router doesn't have anything with a show arp | inc 127.0.0 either. Kind of has me curious.

Just remember one thing though when you are working with your loopback Billy, don't start hacking it...

http://digg.com/security/Worlds_worst_hacker_hacks_127_0_0_1

 

[burtsbees]

Todd---Layer 2 might be the MAC of the adapter that is looped---maybe 127.0.0.1 tells the machine to use the MAC of the local adapter and map it to 127.0.0.1, so it won't have to perform an ARP...

Burt

 

[Cluebird]

Great discussion however, Burt, ICMP is the packet type (echo and echo-reply) that the UTILITY ping uses. Vendors implement ping with slight differences. For instance, some vendors put icmp packets (layer 3) in a UDP wrapper when implementing ping. Others don't. The loopback test was considered so important that the designers of the IP address space "accidently" blew away an entire Class A block just to implement the test. Because it is used to check the TCP/IP protocol stack install, vendors implement that check with a ping loopback command or a ping 127.0.0.1. If your stack is pooched the test fails. Vendors also link the test to the NIC so L2 and L1 can be checked with loopback circuitry. Because the Application layer functionality for the TCP/IP stack is included in the loopback check and because the top three OSI layers map roughly to the Application layer of TCP/IP, for CCNA level work, Cisco courseware and classes teach ping loopback as testing all OSI layers.

CCNA tries to make complicated concepts black or white. Realistically, as you do more research, you find many of the things that are taught as black or white are actually shades of gray. This actually makes it more difficult for someone with lots of experience and knowledge in the "real world" to pass CCNA exams because you may know too much!!!!

Regarding ARP. The RFCs for arp don't indicate what layer of OSI it lives at. The IEEE Ethernet standards do not included ARP as part of the standards. ARP is a binding protocol that glues l2 and l3 addresses for communication within an ethernet LAN. ARP is carried over a L2 frame, but it uses an ethertype of 0806xh rather than the usual 0800xh for IP packets. I've had many discussions over the years with Cisco, students, instructors and vendors about where ARP fits. OSI is a very old model and it really isn't a very good reference for much of what we do. Remember, for CCNA, Cisco puts routers at L3. However, can't a router do access lists? Those go up to L4. And a router can now do firewalling with the right code. Firewalling is considered L1-7 for CCNA.

But you gotta start somewhere. The more you learn, the less you know.

 

[burtsbees]

That is true---switches are L2, but they do specify L3 and L4 switches...why not routers?
I know Cisco taught that telnet does all 7 layers (I remember the question), but I don't remember pinging the loopback.
What exactly do you mean by the tcp/ip stack? What all is included? I always thought that it tested the tcp/ip stack because if the ping fails, then some (or one) OSI layer(s) fail(s). The tcp/ip stack needs layers 1-3 to function, so if any of these fail, then tcp/ip fails. You cannot encapsulate a layer 4 PDU without layers 3 and 2.
Do you know of a vendor that wraps their ping packets inside UDP? I'd really like to capture some packets like that...

Burt

 

[Cluebird]

Burt,

Don't know any vendor that does wrap the ping in UDP. I ran across some obscure document back in 1999 or 2000 that mentioned in passing the UDP wrapping and thought that curious but but tracert took the ping utility and added the UDP portion to collect socket info. I've always wanted to look a the source code for the vendors' implementations of various utilities. It's not hard to find source code for ping, tracert, or other utilities, but I've wondered how the loopback actually runs signals through the "protocol stack". Never got it for some reason...proprietary legalese or something. Anyway, the stretch we make with saying ping loopback tests all OSI layers because it tests the TCP/IP protocol stack and the TCP/IP model maps to OSI has bothered me but not to the point that I have jousted windmills. I don't have access to the test questions but I do know that the newer courses I teach for CCNA no longer try to make the connection between TCP/IP and OSI for the ping loopback. Maybe we can discuss what the meaning of "is" is now?

 

[burtsbees]

lol
Just remember, Tad...Billy (maczen) started this! He's sitting back, watching, eating popcorn and ice-cream and laughing at us...

Burt

 

[maczen]

I am actually out of popcorn! LoL

So we have 1-7 Final Answer? or (2-7/3-7???)

B Haines
CCNA R&S, ETA FOI

 

[lerdalt]

Not to really confuse matters, but I just looked at the Sniffer Technologies poster on my wall from Network Associates, and it has ICMP as a L3 protocol, so I would say final answer is Layers 1-3 of the OSI model.

 

[burtsbees]

Look how Billy started this thread...

"Quick question"...
LOL

Burt

 

[maczen]

Thanks guys!

Burt, remember it was bleed over from another forum that pretty much had the same outcome! Much disagreement! In my defense it was a rather quick question... I personally think that the OSI is just too "gray" to reach an absolute about this topic. As is the older DoD model! (Not even going to go there less there be 1-4/2-4/3-4/3 only etc. LoL I do know one thing! It is past time that I dig deeper into TCP/IP!

Thanks again!

B Haines
CCNA R&S, ETA FOI

 

[Cluebird]

Final answer, L1-7 if you want to pass CCNA.

 

[Cluebird]

lerdalt,

If you want to take a Sniffer Technologies test, then answer the way Network Associates says for ICMP. If you want to pass a Cisco exam, you had best say L1-7 for ping loopback. For other pings, L1-3. I can't be any clearer!!!

Credentials: 1000/1000 on CCNA, one of only a handful of instructors in the world that teaches ALL forms of authorized curriculum for CCNA (Cisco Certified Academy Instructor-CCNA, Cisco Certified Academy Instructor-CCNP, and Certified Cisco Systems Instructor), and well over 100 teaches of CCNA. I'll hopefully add CCIE R&S before the end of the year.

Argue with me and Cisco all you want on this, it won't change the way CCNA looks at ping loopback for now.

 

[lerdalt]

I'm not trying to argue, but I think we all started getting a little mixed up with things. There were so many posts on both here and CLN, that was hard to keep up...plus other things going on.

I had to step back a second and re-read the original question of what layers are tested when pinging the loopback. Since the loopback isn't like a typical NIC, it's going to test all the layers since most of it is all going to be held within software, then yes, it has to test all 7 layers.

Anything else, where it's going to cross our normal cabling system, then it's 1-3.

Another one of those great answers of...it depends? Just depends on what you are pinging.

 

[burtsbees]

CCNA (987/1000), CCNP (945, 966, 978, 989), Cisco Express Foundations Field Specialist (960/1000, 1000/1000).
I can say what I want now...lol

Burt

 

[silverhairb]

Gee, I'm humbled in such company. All I ever got was extra credit for neatness on my 4th grade English composition "What I did last summer". (lol)

[the other] Bill