You are correct when you say that you cannot skip an OSI layer when communicating on the network. However, we can BEGIN our communication at layer 3 and go down to layer 1. In this case we are not skipping layers 4-7. Let me express this in an example:
When you start an FTP file transfer from your computer, you are BEGINNING your communication at the Application layer, or layer 7. As you go down the OSI stack, you cannot skip layer 2 for example. MAC addresses must be placed in the L2 header and appropriate header information must be included. You canât get to layer 1 otherwise. All 7 layers must be traversed because youâre starting from layer 7. Itâs like getting in an elevator on the 7th floor and you want to go to the ground floor. You canât skip floor 2!!
However, if you happen to be on the third floor, you can enter the elevator and go to the ground floor. Youâre not skipping floors 7-4, you just happen to be starting at floor 3 and going down. Thatâs what ICMP is doing.
Similarly, ARP is a layer 2 protocol and does not know layers 3-7 exist. Similarly routing protocols (EIGRP, RIP, OSPF etc) all operate at layer 3. CDP, VTP and LACP are examples of protocols that exist only on layer 2 and know nothing of upper layers.
Using the elevator analogy, you can see that we are not skipping layers, we are just getting on the elevator at a different âfloorâ to start our journey down.
Great explanation, thatâs very usefull to me, thank you again Lazaros.
One more question :-
If there are more than one host that pinging or telent to the same destination ( router for example ) that mean we have more than one session and that sessions are separate from each other ( layer 6 function ), if thatâs right, so who is deal with this function if we started from layer 3 and layer 6 does not exsist !!??
If you have two hosts pinging the same destination, you are not creating sessions. Sessions are created by TCP on layer 4 with a three way handshake, port numbers, windowing and other functionality. Here there are no sessions. There is just a series of packets that are sent from a host to the destination (the router in your example). Packets are responded to on a first come first serve basis regardless of which host they came from.
This detailed sequence may help:
Host A wants to send a ping (echo request) to IP address 10.10.10.1 (the router). The encapsulation process begins at layer 3 where the source IP address (10.10.10.2) and the destination IP address (10.10.10.1) are placed in the header. This is then encapsulated in a frame where source and destination MACs are placed in the frame header. This is then placed into the physical layer where information is converted to bits and those bits into electrical signals on the wire.
When these electrical signals reach the destination, deencapsulation begins. The frame header is read, source and destination MAC addresses are read and the device confirms that the frame belongs to it. Deencapsulation continues where the source and destination IP addresses are read in layer 3 as well as the ICMP header information where an echo request has been recorded. The device doesnât deencapsulate any further because there are no additional headers to deencapsulate. No sessions are created as a result.
The router then creates an ICMP echo reply placing the appropriate information in the header, places IP addresses in the IP header, encapsulates to layer two with MAC addresses and placed on the physical layer to be sent over the wire.
The process is reversed at the host when the packet reaches its destination.
Keep in mind that layer 3 protocols (IP essentially) are connectionless. This means no session is created. The packets are sent and âforgottenâ without any mechanism of tracking each individual one.
Hi again Lazaros,
I have a small question about what you said to me before :-
âIf you have two hosts pinging the same destination, you are not creating sessions. Sessions are created by TCP on layer 4 with a three way handshake, port numbers, windowing and other functionalityâ
You tell me that sessions are created by TCP on layer 4 and Rene explain in the introduction to the OSI Model lesson that session layer that holds this function, So can you please explain the relationship between what you said and what Rene said ??
Thatâs a very good question. The different use of terms can become confusing. First of all, when using protocols such as TCP/IP, we are actually using the TCP/IP protocol stack which has four layers: Network Access, Internet, Transport and Application. However, when we speak about the layers in which protocols function, we always use the OSI model. For example, we say âlayer 3â (of the OSI) for the IP protocol, even though itâs âlayer 2â in the TCP/IP model. For TCP and UDP, we say they function at layer 4 of the OSI even though they are at layer 3 of the TCP/IP protocol stack.
What makes it more confusing is the fact that for the Transport layer, TCP creates what is called a TCP session. This is not to be confused with the Session layer 5 of the OSI model. The session begins with a 3-way handshake between the two hosts that are communicating to signify the beginning of the session. Data is exchanged during the session and it ends with a four way handshake that terminates the session.
The Session layer of the OSI model isnât actually used when using TCP, because TCP/IP does not follow the OSI model. To find out more about the Session layer of the OSI model, check this out: http://www.cisco.com/cpress/cc/td/cpress/fund/ith/ith01gb.htm#xtocid1668415. Keep in mind however, that in the world of TCP/IP, this layer is non existent.
In your reply to Durga âThe reason that Cisco/Unix/Linux do not do this is in case there is an intermediate firewall that filters on ICMP. In this case, the Windows tracert will not get through, but the Cisco/Unix/Linux probably would.â
As an administrator i wont open any port until unless its necessary , All will be explicitely denied so How a UDP packet will cross my firewall.?
Ajay,
So to be clear here, we are talking about two types of devices: 1) The target of trace route and 2) the devices through which the trace route is travelling (for example, ISP equipment). For type #2 devices, there wonât be filtering on what kinds TCP or UDP ports will be allowed to pass across them (which is different than saying what kinds of TCP or UDP ports they will accept TO them). Although TCP and UDP traffic can almost always flow freely through an Internet providerâs network, sometimes ICMP is blocked by that ISP. This would break a trace route that depends solely on ICMP that attempts to traverse that providerâs network.
In your case, you are not a service provider. Your firewall would likely be a destination rather than a transit point for other Internet traffic, so it doesnât matter that you block the UDP port. In fact, Cisco/Linux/Unix is betting that you have blocked itâthatâs the point of picking a random UDP port. The UDP based trace route is expecting the port to be blocked so it gets the return path information.
Are we assuming in this case that both R1 and R3 have static routes in places to reach each others networks? I just wanted to clarify as I am confused why packets would know how to reach R3 and back and forth. It may sound a stupid question but please can you help.
First of all there is no such thing as a stupid question. Secondly, yes, you are correct. R1 and R3 must have some sort of routing (either static or dynamic) to be able to find each otherâs networks.
I hope this has been helpful!
Laz
shantel
(Shantel - Networklessons.com)
Split this topic
34
Thank you for your explanation. It really helped me to understand how encapsulation happens. But I have a slightly different question. Can we start a communication from Layer-2? Just as we created ICMP packet from Layer-3 is there any way we can create a Frame from Layer-2 directly?
Thank you for your amazing tutorials. I have few doubts and I am sorry if I have missed it in your explanation. You have mentioned that Cisco router will try multiple probes and we are restricting to one by mentioning probe =1.
Does probe means the number of attempts?
I did a âtracert 8.8.8.8â on cmd and it showed a list of hops to googleâs dns server.
Why R3 replies port 33435 as unreachable? Why is the port number increased on each attempt of traceroute? Same port number can exist on all hosts.
There are protocols that âliveâ at Layer 2 and do not go any higher on the OSI model. STP uses BPDUs which are layer 2 frames that are exchanged for the functionality of spanning tree protocol. ARP is an exclusively layer 2 protocol. Cisco Discovery Protocol (CDP) is also a layer 2 protocol. PPP and L2TP are also layer 2 protocols that exchange frames at layer 2 to function. All of these initiate communication at layer 2 and do not go higher on the OSI model.
In traceroute, a probe is the number of ICMP echo requests sent to each individual hop. So if a traceroute has 7 hops to the destination, the Cisco device will send three probes, or three ICMP echo requests to each of the 7 hops for a total of 21 ICMP echo requests. If you select one probe, a single ICMP request will be sent to each hop. You wonât actually see a difference in the traceroute output.
By default, Cisco begins its traceroute on port 33434. Each hop that it traverses, it increments the destination port by one. This is how the traceroute command has been designed. You can adjust the default starting destination port by using the extended traceroute commands.
You can find out more information about the traceroute command on Cisco devices at this Cisco documentationâŚ
Hi Liz, One last question on working of Traceroute. How the initial host (which generates icmp/ udp packets) knows that it has found the target? I mean what is special in a âPort Unreachableâ message which makes it think that the packet has reached the destination. ( i. the corresponding port is not active on the destination ii. The packet is intended for it. Hence it sends port unreachable message, do I make sense???)