Osi

Christopher Dobkowski

Hi there folks!

I've been asked a question that goes something like this:

A host PC has set his default gateway to 10.10.10.1 and when he pings his default gateway, what he gets are 4 ping packets sent and none returned saying "Request Timed Out", so it's 100% fail... At which OSI Layer is the problem?

A - Data-Link
B - Application
C - Network
D - Transport
E - Session

What do you think?

atorven

What do you think?

FloOz

ICMP runs at the network layer

ptilsen

There is not enough information to determine the layer at which the problem is occurring. However, for test-taking purposes we can safely induce that A is the correct answer.

Successful Ping responses (or any ICMP utility's response) effectively tell us that things are functioning between layers 1 and 3, at least when it comes to connectivity between two hosts. Since in the example he is Pinging the default gateway, Network is ruled out. Since unsuccessful Pings generally mean the problem is at 3 or lower, that leaves only data-link and network of the available answers. Since the default gateway is specified as the target host, that leads to the assumption that the problem is occurring intra-subnet and is therefore a data-link problem.

However, ICMP specifically could be blocked at his gateway (layer 4). He could also have a software firewall blocking ICMP or specific applications. He could also have the subnet mask on the gateway misconfigured (layer 3) such that the host's IP is outside the gateway's subnet, which will cause it not to respond to Ping from the host. And a physical layer issue could certainly cause the issue, but we can surmise it is not physical since that is not an available

For the purpose of a Cisco test, the correct answer would be A for the reasons I laid out at the top. A Cisco test, at least at this level, will generally focus around network devices and network theory, which precludes the other possibilities I laid out. In the real world, I would contend it is actually just as likely the default firewall configuration on the host is blocking Ping or that an IP address or subnet mask is misconfigured. In the real world, I have seen junior admins waste lots of time troubleshooting non-existent network issues because of a misconfigured subnet mask or a firewall left on the default configuration.

DANMOH009

I'd like to know what the answer is to this, because although i completely understand and agree with what ptilsen, i remember during my CCNA studies the correct answer was always taken from the protocol mentioned in the question. So on this one i'd answer the same as FloOz and go for the network layer.

Christopher Dobkowski

Well I answered Data-Link as lowest as possible, if there was Physical i would circle the Physical.. But I've been told it's NETWORK LAYER... and as an explanation i got this -> "The Network layer is responsible for network addressing and routing through the internetwork. So a ping fails, you may have an issue with the Network layer (although lower layers like Data Link & Physical may cause the problem)." .. And I was like.. WHAAAT? That's not correct.. 1st how should I know from a PING at what layer the problem is? It can be either Physical - Data-Link and Network... This question is pointless.. But for exams sake what should I chose? I'm sitting for the CCNA this Monday..

DANMOH009

Personally i'd choose Network if i was you. I understand the logic that everyone's using, However i taught myself to look at a key feature of the question, If it mentions ping - i'd go Network. CDP/ARP etc... i'd go data link... and so on...

Im sure a few people here might dis agree with that, its the way i studied for the exam, and i did ok.

networker050184

I agree with DANMOH009, while we could dissect this down to a possible physical layer issue, sometimes testing is about figuring out what answer the question is trying to get. This is the reason why some people know the subject in and out but just aren't great 'test takers' and why some people can get by with nominal knowledge on a subject but have better 'test taking skills.'

Node Man

My first attempt to answer a question The ping function works on layer 3. Which is the layer for routers. Ping is a test of IP addresses. Layer two is switches which use mac addresses.

Christopher Dobkowski

Mhmmmmm... I understand now, that is kinda wrong of them to ask some questions like that, cause in real world that may cause problems to other people... They may become confused etc.. But anyways, now I understand the Logic :P Thanks ALOT to very single one of You!

Btw. Happy New Year to Every One!

ptilsen

To Ping a gateway on the same subnet does not require traversing the network layer, since default gateway is by definition on the same subnet. While Ping does run over IP, the key here and I believe the point of the question is understanding that the network layer is not needed for communication within the same subnet.

I agree that ICMP being part of IP makes it a layer 3 protocol, but I do not agree that that is the intent of the question. I took the intent of the question to be identifying that Pinging a same-subnet device such as a gateway does not require routing, and therefore it is not a layer 3 problem.

FloOz

"ICMP helps control and manage IP’s work by defining a set of messages and
procedures about the operation of IP. Therefore, ICMP is considered part of TCP/IP’s
network layer. Because ICMP helps control IP, it can provide useful troubleshooting
information. In fact, the ICMP messages sit inside an IP packet, with no transport layer
header, so ICMP is truly an extension of the TCP/IP network layer" -Wendell Odom

The ICMP Time Exceeded message notifies a host when a packet it sent has been discarded
because it was “out of time.” Packets are not actually timed, but to prevent them from being
forwarded forever when there is a routing loop, each IP header uses a Time to Live (TTL)
field. Routers decrement the TTL by 1 every time they forward a packet; if a router decrements the TTL to 0, it throws away the packet. This prevents packets from rotating forever

ptilsen

I am not disputing ICMPs' place in IP or the OSI, nor the time exceeded message. The question is about why the error message is given. That error message will be given if a physical or data-link layer problem prevents any connectivity between two hosts. As with almost any problem, a problem at a given layer can indicate a cause at any layer beneath it.

In this case, since the destination host specified is the default gateway, I contend it is more likely a physical or data-link layer problem and that that was the question's intent. The only network-layer issue that could cause the Ping to fail in this case would be an IP misconfiguration. Since the question does not specify any IP configuration other than the default gateway's, I assume that IP configuration is irrelevant. The only reason to include the fact that the destination host is the default gateway is to identify that the issue is intra-subnet and therefore likely caused by a sub-3 issue. If the destination host were not specified as being anything in particular, there would be no assumable answer.

It has admittedly been a while since I studied for a Cisco test, but I don't recall identify-the-problem layer questions as being intended to identify the layer on which a given protocol operates. I recall them being intended to identify the layers excluded by the premise of the question.

I did just notice my original post didn't include "network" as a valid answer in the second paragraph without explaining why. I have edited it to clarify, since ICMP obviously is a part the network layer and network layer problems can certainly cause Ping failures.

bryguy

I'm going to go with Network layer because it is the simplest explanation that is consistent with the data available in the question. I'd rule out physical, and data link layer because in a troubleshooting scenario, you typically work your way up the 7 layers, starting with the physical, then move up to the data link layer, and then check the network layer.

The fact that he's using ping, implies that he's already checked the preceding two levels.... meaning there are better tools available than ping to diagnose physical, and data link issues.