Arp N Icmp

ARP and ICMP Which layers??
biplab 16 posts since Jun 8, 2011

ARP and ICMP Which layers?? Oct 25, 2011 9:13 AM
hi everyone,
i have read a few books including the cisco ccna cetification guide and the 31 days before ccna. I found
that these books have stated ARP and ICMP as a layer 2 protocol for OSI model (i.e. data link layer) and a
layer 2 for TCP/IP model too (i.e. Internet layer). But if the protocol were to tally shouldn't the ARP and ICMP
be on the first layer of the TCP/IP model since the first layer links directly to the data link and physical layer of
the OSI model and data link defines the ARP and ICMP??
thank you,
Biplab
Tags: osi, ccent, switch, ccna, ip, switching, ccna_exam, tcp
Helder Neves 353 posts since Jun 17, 2011

Re: ARP and ICMP Which layers?? Oct 25, 2011 9:17 AM
ARP and ICMP is layer 3 - Network Layer.
Layer 2 is Ethernet, PPP, HDLC, DSL, Frames, Network Switching, MAC address ...
Regards

in response to Helder Neves
Thanks, Helder i was a bit confused on this one i will set that to my mind.
Regards,
Biplab
Scott Morris - CCDE/4xCCIE/2xJNCIE 8,435 posts since Oct 7, 2008

ICMP is a Layer3 protocol. Not sure who said it was Layer2.
2015 Cisco and/or its affiliates. All Rights Reserved. Generated on 2015-05-24-07:00
This document is Cisco Public Information.
1
ARP, on the other hand, while I might be willing to say it's Layer 2.5, I really have a hard time calling it a Layer3
protocol because there's nothing about specific or hierarchical addresses to it at all!
It's a broadcast sent AT LAYER2 in order to figure out who has a Layer3 IP address. So it SUPPORTS layer
3, but that doesn't make it a Layer3 protocol.
(Although it's funny this question came up because in the CCIE Security meeting group I'm in this week,
someone pointed out an article on Cisco's web site that called ARP a Layer3 protocol and so we all had been
debating that and laughing about it.)
HTH,
Scott
Helder Neves 353 posts since Jun 17, 2011

in response to Scott Morris - CCDE/4xCCIE/2xJNCIE
Hmm im a bit confused now lol. At now i think it is a layer 3, i have read now on books it is sended to discover
MAC ADDRESSES, so it can be called a layer 2 protocol, other reason to be a layer 2 is, ARP send a
broadcast frame so is layer 2 because layer 3 devices dont forward broadcasts !
Whats your opinion?
Regards
Garri 111 posts since Jun 20, 2011

Re: ARP and ICMP Which layers?? Oct 25, 2011 11:44 PM
Hi biplab,
ARP runs on top of layer 2 protocol, i.e. using services provided by data-link protocols. ICMP runs on top of
layer 3 protocol.
For example, ICMP uses IP protocol to delivery ICMP datagram to remote host in remote, non-local network.
ARP uses Ethernet protocol to flood out question "Who is x.x.x.x?' over switched network.
Kind Regards,
Garry
Message was edited by: Garry
2

Internet Layer
IP (IPv4 IPv6)
ICMP
ICMPv6
IGMP
IPsec
Link Layer
ARP/InARP
NDP
OSPF
Tunnels (L2TP)
PPP
Media Access Control (Ethernet DSL ISDN FDDI)
this is what i found in wiki. And where did the data link layer came from on TCP/IP stack. They should either
define it as a network access layer or change the whole stack to OSI reference?? Confused...confused....So
if i tally the arp to TCP/IP, should not that be in the layer one of the TCP/IP ?? but the book here says it's on
layer two of TCP/IP which is linked to the third layer of the OSI model when referenced??
regards,
Biplab

in response to biplab
biplab, you shouldn't consider ARP as the datalink protocol, as it doesn't transport the layer 3 protocols.
Rather, as Scott said it is a function (component) of the layer 3 protocols, such as IP, to determine a hardware
address of a host. ARP uses the layer 2 protocols to complete this function.
HTH, Garry
,

in response to Helder Neves
If you're on a Layer2 network, why would you need to forward broadcast across a Layer3 boundary?
3
Yes, it's needing to figure out a MAC (the reply). And it knows the IP address. but in the FRAME HEADER
(note, not an IP header) there is no hierarchical address information. That's in the content/data.
Like Garry says it just asks the question of "who has x.x.x.x?"...
ICMP though has information that directs it (potentially across Layer3 boundaries) to a specific layer 3 address.
ARP will not cross any Layer3 boundary and has no reference to reach a specific layer 3 address.
All the joys.
Scott

thank you everyone for your help.
regards,
biplab

There is a video on CNL describing both.
https://learningnetwork.cisco.com/docs/DOC-1642
Kind Regards,
Garry
Bikas Pandey 47 posts since Jan 4, 2011

ARP is layer two and ICMP is layer 3 protocol
Elvin Arias 2,585 posts since Mar 12, 2010

ARP is layer two and ICMP is layer 3. Good discussion .
Elvin
Paul Stewart - CCIE Security 7,582 posts since Jul 18, 2008
4
in response to Elvin Arias
The OSI model is just that, a model. Therefore, you will find inconsistent opinions. In my mind ARP is clearly
a layer two protocol. It enables IP over Ethernet. ICMP is a layer 3 protocol that depends on IP. There is more
gray area in calling ICMP layer a layer 3 protocol than calling arp a layer 2 protocol. At least in my opinion.

I think we should classify a protocols running directly on particular layer of OSI model (using the transport
services of the protocols running at lower layers and providing the transport services for the protocols
running at upper layer), and the protocols running between layers of the OSI model (using the transport
services of the protocols running at lower layers, not providing transport services to upper layer protocols,
but specific supplementary services).
For example,
- Ethernet and PPP runs directly on a layer 2 of the OSI model (for instance, Ethernet using the transport
services of layer 1 electrical signal transmission and providing the transport services for layer 3 IP and layer 2.5
ARP).
- ARP runs on top of a layer 2 (for instance, ARP using the transport services of the layer 2 Ethernet and
providing a supplementary services for layer 3 IP, not transport services).
- IP and IPX runs directly on a layer 3 of the OSI model (for instance, IP using the transport services of layer 2
Ethernet protocol and providing the transport services for the layer 4 TCP or UDP, or maybe for the layer 3.5
ARP protocol). 3.5 - for simplicity :).
- ICMP runs on top of a layer 3 (for instance, using the transport services of layer 3 IP and providing the
supplementary services for applications).
Paul Stewart - CCIE Security 7,582 posts since Jul 18, 2008
in response to Garri
Gary,
I don't disagree with your logic. However, there are instances where protocols don't necessarily fulfill the
other requirements of a layer of the OSI model. In some cases these are clear. For example, IP and IPX are
clearly layer 3 protocols. They utilize the datalink layer for transport (I agree with that). Arp also uses layer
two for transport, but it clearly has no layer 3 headers (only layer 3 data), is not routable, and is an ethernet
only concept. People make arguments that it should be classified at layer 3. I would argue that it doesn't fulfill
the intent of layer three of the OSI model. The OSI model was not built around the IP Protocol. ICMP is also
a gray example. It does not have the features of a transport layer protocol, but clearly depends on IP as a
transport mechanism. When you get above the transport layer, the concept of encapsulation goes away, and
thus some of the dependency on lower layers transporting upper layers (at least with in the upper three layers).
5
These are great conversations. The bottom line is that the OSI model is just that--a model. When applied,
we won't all agree on how it relates. However, these discussions clearly illustrate everyone's understanding
of the protocols. That's far more important that the interpretation of the intent of a layer in the model (a it's
applicability to a protocol).
Vijay Swaminathan 491 posts since Aug 29, 2008

Regarding Post 6, I really doubt the authenticity of this information.
OSPF at Data Link Layer ?? I really doubt.

in response to Vijay Swaminathan
Hi Vijay,
I agree with you, OSPF work on top of OSI layer 3 protocol. IP protocol uses decimal 89 value to represent
OSPF protocol.
Kind Regards,
Garry

in response to Vijay Swaminathan
A template, presented in wiki actually the TCP/IP template, not OSI model. TCP/IP Link layer defined as '
the group of methods or protocols that only operate on a host's link'. OSPF included in TCP/IP Link layer
because it runs on a host's link.
More detailed information about TCP/IP Link layer definitions

http://en.wikipedia.org/wiki/Link_Layer
Kind Regards,
Garry
Brian 2,971 posts since Aug 17, 2009

in response to Garri
6
Per RFC 792 & 1122, ICMP is one of the core protocols of the IP protocol suite, which includes IP, ICMP and
IGMP. ICMP, uses the basic support of IP as if it were a higher level protocol. However, ICMP is actually
an integral part of IP, and must be implemented by every IP module. Per RFC 1122, ARP is part of the Link
Layer.
Hope this helps.
Brian
reamea7 2 posts since Aug 14, 2011

Re: ARP and ICMP Which layers?? Apr 11, 2012 8:02 AM
I think ARP is layer 3 because i can't "show arp" full information on layer 2 deviece but i can "show arp" full
information on layer 3 deviece.
jneiberger 465 posts since Jun 10, 2010

I like to think of ARP as a subnetwork convergence protocol. As you said, layer 2.5. It has features of both
layers, in a way. I see no reason to shoe-horn it into the pared-down OSI model that Cisco teaches. Well, other
than the fact that they might ask you about it on a test.

This question would be an example of Cisco trying to shoe-horn certain concepts into their simplified OSI
model and I don't think it really fits well. ARP isn't an OSI protocol, but it fills the role of what the OSI refers to
as subnetwork dependent convergence facilities. The IETF would probably say it is layer 2.
ICMP rides on IP, so some people would say it is layer 3. I think this is again trying to shoe-horn a concept
into a simplified model. ICMP is a layer management protocol that doesn't fit into the data plane. It is a control
plane (or maybe management plane) function that legitimately should reside in a parallel stack next to the data
plane stack.
Sorry if this just adds to the confusion.
reamea7 2 posts since Aug 14, 2011

In exam you should answer ARP is layer3.
7
Annamalai 734 posts since Jan 1, 2011

ARP is a layer 2 (As it finds the IP address using MAC address {broadcast} )
ICMP is a layer 3 (Used to reach and check the path using IP address)
Joshua Johnson - CCNP R&S 6,068 posts since Sep 22, 2009
Scott Morris - CCDE/4xCCIE/2xJNCIE wrote:
ICMP is a Layer3 protocol. Not sure who said it was Layer2.
ARP, on the other hand, while I might be willing to say it's Layer 2.5, I really have a hard
time calling it a Layer3 protocol because there's nothing about specific or hierarchical
addresses to it at all!
It's a broadcast sent AT LAYER2 in order to figure out who has a Layer3 IP address. So it
SUPPORTS layer 3, but that doesn't make it a Layer3 protocol.
(Although it's funny this question came up because in the CCIE Security meeting group I'm
in this week, someone pointed out an article on Cisco's web site that called ARP a Layer3
protocol and so we all had been debating that and laughing about it.)
HTH,
Scott
haha, good thing you weren't drinking or you would have been fist fighting about it
in response to Joshua Johnson - CCNP R&S
Sounds like a good start for a Cisco movie. Scott involved in a royal rumble over ARP.
Shocken85 3 posts since Jul 23, 2013

In Kevin Wallace's Network+ Cert Guide (9780789748218), he clearly states ICMP is a layer 4 protocol. Picture
of text is attached.
8
Sorry if I added confusion, but I, myself, am
confused.
Brad 327 posts since Aug 8, 2012

These type of questions are asked all the time on these forums and they always get a lot of attention. The
reason is that there are passionate people on both sides. ARP is layer 3 vs layer 2. ICMP is layer 3 vs layer
4. Both sides have completely valid arguments to defend their positions. The truth is that some protocols don't
fit perfectly into a single layer. The only reason it matters is when you're asked about it on a test. For those
occasions simply understand what the tester's position is and give that answer. That doesn't mean it's the right
answer, it's just their answer.
No matter who takes what position there will always be someone who disagrees. Just remember it's quite
possible that you're both right and in the end it really doesn't matter.

9
in response to Shocken85
That is incorrect. ICMP is implemented as part of the network layer. I think many get confused because it
is (necessarily) encapsulated within IP packets, so they assume that it must reside at the layer above IP.
Unfortunately, the simplified OSI model that Cisco likes to teach does not fit here, and neither does it fit with
ARP. There are many arguments about whether ARP is layer 2 or 3, when it is in fact neither if you want to fit it
into OSI. It is a subnetwork convergence protocol that is a bridge of sorts between layers 2 and 3.
But as Brad said just a few moments ago, most of this is actually irrelevant and you'll find no shortage of
people who disagree about what goes where. In the end, as long as you know what the protocols do, it's not
so important to know what layer they're at. Unless of course you get asked that question on an exam, in which
case the right answer is always the Cisco answer. :-)

Is there someone involved in the making of the Cisco examinations we could ask that can tell us what the
answer is? Its ridiculous that everyone (including me) knows what ICMP is and how it works but could still get
the question wrong on a test. I'm not discrediting anyone here, there is just more than one CCNP/CCIE that
have different views. That question is definitely on the exam I took last time so there should be a known answer
even though there are different points of view. Wendell Odom writes the official CCNA cert books, so I'll try and
see if there is a way to ask him and let you guys know.
Thanks for the replies,
-Trent

I just dusted off a CCNA study guide (Sybex, Todd Lammle) and he agrees that ICMP is network layer. That's
probably a safe answer.

Read my earlier post #19. ICMP is OSI layer 3 (Network layer) and ARP is OSI layer 2 (Date Link layer) . If
you use the TCP/IP Model or Internet Protocol Suite, then ICMP is layer 2 (Internet layer) and ARP is layer
1 (Link Layer). Neither of these protocols were developed under the OSI framework model, but rather the
Internet Protocol Suite framework.
HTH
10
Brian

Alright, it makes sense now (to me at least anyway) for ICMP. I have Lammle's book, Wikipedia, and multiple
other sites like the one listed below on my side . ICMP is a Network layer protocol. I don't care what this
Network+ book says... After I got done reading that section, there is a review question at the end that reads
"What layer 4 protocol is used by the ping command?" (IGMP, PIM, ICMP, or RTP) What a mess, eh?
By the way, Lammle's book was the best, in my opinion, at teaching subnetting.
Thanks for the contributions to this question.
-Trent
http://www.windowsnetworking.com/articles-tutorials/network-protocols/Understanding-ICMP-Protocol-
Part1.html
stardust 206 posts since Jan 4, 2010

Wendell Odom's book says that "ICMP messages sit inside an IP packet, with no transport layer header,
so ICMP is truly an extension of the TCP/IP Network layer". ICMP packets do not use UDP or TCP. It's
considered to be another protocol under the Network layer.
I also read from somewhere either Cisco's or Wendell's that ARP is a Layer 2 protocol under OSI.
in response to stardust
I love this thread
in response to Joshua Johnson - CCNP R&S
Is everyone on the same page now?
11
Juraj 1 posts since Oct 9, 2013

Hellou, I hope this is not off topic but this is how I understand layer concept of TCP/IP:
Updated model of TCP/IP is protocol stack that is divided into five layers (application-transport-internet-data
link-physical). Every layer has protocols that have some functions in common. Protocols are used by processes
which are handled by CPU on devices used in network like switches, bridges, routers, computers, servers and
so on. Protocols from higher layers use protocols and services from lower layers to deliver data.
If we use some protocol, device will use protocols from all layers that are below that protocol. So if we use http
from application layer, device will than use tcp from transport layer, ip from internet layer, ethernet from data
link layer and send it over the cable. If we use ICMP from internet layer, device will than use ethernet from data
link layer and send it over the cable.
Data are sended between devices ussualy from all the way up from application layer and goes down through
all layers below application layer: L5-L4-L3-L2-L1. So the sending of data is started by some process which
use protocol in application layer. On the receiving device, it goes through all layers like sending device, only in
backwards: L1-L2-L3-L4-L5. Switches and routers are exception, because switching process use only info in
L2 header and routing process use only info in L3 header.
There are cases when devices do not start sending data from top layer, which is application layer, but from
lower layer, L2 or L3. On these two layers, there are protocols that are used by processes that do not need
protocols from upper layers. For example L2 has arp, stp or cdp protocol and process, that is using them will
use only L2 and L1 layers to deliver data. L3 has ICMP or IGMP and process that is using them will use only
L3, L2 and L1 layers. Normally, protocol from layer N+1 is encapsulated with header of protocol from
Layer N, but protocols like arp, stp, cdp, icmp or igmp are exceptions and they are encapsulated with
header of protocol that is from the same layer.
Please correct me if I am wrong
Preet D'Souza 14 posts since Aug 6, 2014

Re: ARP and ICMP Which layers?? Aug 6, 2014 7:20 AM
Per RFC 791 which provides the Internet Protocol specifications, ARP is essenially a network layer protocol
(Layer 3) although not explicity stated to be.
This is evidenced from the text below obtained from the 'Model of working' section of the RFC 791.
Please read the entire paragraph for better understanding.
The internet module prepares a datagram header and attaches the data
to it. The internet module determines a local network address for
this internet address, in this case it is the address of a gateway.
It sends this datagram and the local network address to the local
12
network interface.
The local network interface creates a local network header, and
attaches the datagram to it, then sends the result via the local
network.
The underlined text clearly states that the internet module (IP module) first determines the local address
(physical or MAC address in case of Enthernet) and then passes it on to the network interface (Data link layer)
which adds a local network header (L2 header) and transmits the frame over the physical network.
When a higher layer intends to request a service from a lower layer, it must pass certain infromation along with
the request.
In case of network-data link (L3-L2) layer interaction, the network layer provides the local network address
(MAC address in case of Enthernet) along with certain other information to the Data Link layer in order to
enable the Data Link layer to address the frame to the correct node (host, router or gateway).
This would imply that ARP is more of a utility defined in and used by the Internet Protocol in order to ascertain
the physical address based on a logical address.
USA_firefly 100 posts since Jul 15, 2014

Re: ARP and ICMP Which layers?? Aug 18, 2014 8:07 PM
Hi, Shocken85,
I'm studying for CCENT and using Odom's book.

ICMP works on layer 3 and ARP works on Layer 2 according to his book.
I trust him
I'm almost 100% sure these are correct answers for the exam
I'm sorry, guys. Didn't read the book correctly.

Page 111 of OCG states: "Other Network Layer Features.
...
Domain Name System
Address Resolution Protocol (ARP)
Ping"
So, the correct answer: both ARP and ICMP work on Layer 3.
Regards,
USA_firefly
Message was edited by: USA_firefly
13

in response to Preet D'Souza
While this is a very good logical construct for what ARP is, I think it's more important to look at the actual
packet output itself.
And ARP packet at Layer 2 is sources from your REAL MAC address, but destined to a broadcast (All F's)
addresss.
At Layer 3, what information does it acually have? Check it out:
http://wiki.wireshark.org/AddressResolutionProtocol
Scott

I believe we can agree to disagree or we can simply agree that ARP lies in Layer 2.5 as you mentioned earlier
Once I'm done reading about and understanding ICMP, the debate shall continue albeit on a different protocol.

Hi, Scott.
I'm sorry but I have to disagree with you.
Both ARP and ICMP work on Layer 3 of OSI model.
In order for devices to be able to communicate with each when they are not part of the same network, the
48-bit MAC address must be mapped to an IP address. Some of the Layer 3 protocols used to perform the
mapping are:
Address Resolution Protocol (ARP)
Reverse ARP (RARP)
Serial Line ARP (SLARP)
Inverse ARP
http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_arp/configuration/15-mt/arp-15-mt-book/arp-
config-arp.html
While this is a very good logical construct for what ARP is, I think it's more important to look
at the actual packet output itself.
14
We cannot this too much about it

On this forum we want to hear the "right answers" for Cisco exams.
So, the correct answer for the exams: both ARP and ICMP work on Layer 3.
Regards,
USA_firefly
Message was edited by: USA_firefly
Jean 119 posts since May 10, 2014

in response to USA_firefly
USA_firefly
Since a router CAN NOT foward an ARP packet to me ARP is a layer 2 protocol. my one cent lol!

in response to Jean
Hi, Jean,
I'm afraid Cisco will not appreciate "your one cent". When you answer the question this way it will be incorrect.
Please, stop confusing other people.

Please, read the following link. This is an official Cisco document.
http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_arp/configuration/15-mt/arp-15-mt-book/arp-config-
arp.html
Good luck with your studies.
Regards,
USA_firefly

It is not my intention to confuse anyone.
I am sorry if you feel offended by my opinion
15

Having taught the CCNA curriculum in a Cisco Network Academy, I can tell you that ARP and ICMP are
considered Layer 2 and Layer 3 protocols respectively in regards to the OSI model.
Why?
1) ARP does not propagate past a Layer 3 boundary.

2) It has no IP header.
3) It is broadcast to the Layer 2 address of all 1s. (ffff.ffff.ffff).
4) ICMP does not have a transport Layer 4 protocol.
5) Incorporated into the IP protocol suite, which includes IP, ICMP and IGMP.
6) Has IP header information to route the packet.
HTH
Brian
sarah 2,313 posts since Sep 12, 2013

66 posts since
Jul 16, 2014

42. Aug 19, 2014 7:06 AM (in response to Scott Morris - CCDE/4xCCIE/2xJNCIE)
Re: ARP and ICMP Which layers??
Hi, Scott.
I'm sorry but I have to disagree with you.
Both ARP and ICMP work on Layer 3 of OSI model.
USA_firefly,
Very interesting, and thank you for bringing this up.
16
Could you provide some real output, other than theoretical documentation which shows us what you are saying
and that ARP fulfills the intent of layer 3 of the OSI model?
Jon 157 posts since Mar 8, 2011

in response to Brian
I dont get it. ARP is used to service MAC and MAC is layer 2.
Anyone notice what layer MAC addressing is?

in response to Jean
Hi, Jean,
It's alright, man

I'm not offended.
Regards,
USA_firefly
17
It's perfectly fine to disagree with me. However, that doesn't mean you are correct.
There are indeed Cisco documents out there that are incorrect. You seem to have found one, at least in the
wording of things. So hopefully that's not what someone decided to write a test question off of without regard
to reality!
The CCNA materials have been around for over 15 years now, and fortunately, ARP has not changed. So,
having been through the curriculum from a teaching point of view and having been through the exam before, I
would find it hard to believe that the answer would suddenly change or make it through an exam revision and
review worded like that!
My suggestion, as will be the same as you move up through CCNP and CCIE stuff is to dive into the details of
whatever it is... Wireshark... RFCs... Things that actually shape reality rather than one person's post or one
document that you happen to find!
Cheers,
Scott

in response to Brian
I'm sorry, Brian, but I have to disagree with you.
Please read this official Cisco document

http://www.cisco.com/c/en/us/td/docs/ios-xml/ios/ipaddr_arp/configuration/15-mt/arp-15-mt-book/arp-config-
arp.html
which states that ARP is Layer 3 protocol.
I do understand your logic. I might even agree with you.

However, It's Cisco world. And for Cisco exams ARP is Layer 3 protocol.
Regards,
USA_firefly

18
We really need to think before contending a noted mentor. It's fine to argue and debate, but making an outright
conviction, and direct it towards the professionals is not professional, specially when we are at CCNA level and
they have years of experience to back them up.
This just show's our own lack of ability to comprehend and while jumping to conclusions in the heat of the
moment. I have done it around here much, well learning to learn from the best with patience.

in response to Jon
Hello Jon,
ARP is not used to service MAC, rather it is used to service the next higher protocol, namely IP.
Essentially, MAC addresses are used for data transfer within the same network, however, without IP, they are
useless. One can say that MAC addresses are actually an aide to the routing process carried out by IP within
each IP subnet/network. This also solidifies the fact that each upper layer protocol avails of a service from
lower layer protocols.
ARP seems more like a Layer 3 utility defined at Layer 2.

Hi USA_firefly
I am in this forum to learn and I thought you too. let's stay professional beside the difference in how each one
understand Cisco document.
It looks to me that people sometime don't remember why we are here.

in response to Jean
Hello Jean,
You may be in this forum to learn as the rest of us are, granted.

However, contribution/teaching is as much a part of learning as learning itself.
I believe USA_firefly is well within the requirements of this forum to question and disagree on certain
contentious topics. In fact, that's how many, including myself have learnt and how we continue to do so.
We debate different topics based on the available texts and our understanding of the same, that's how we grow
in knowledge.
19

Preet,
So are your car keys regarded as part of you or as part of your car? They are certainly needed to interface
between the two layers. But their FUNCTION is more with the car itself, therefore they're considered that way.
Yes, ARP is needed to interface between logical addresses (L3) and physical addresses (L2), but it's
FUNCTION is at L2, therefore it's an L2 protocol.
Sarah,
Thank you for the note, but I didn't take it personally! Debate is half the fun, at least as long as people don't
walk away bent out of shape! If someone disagrees with me, it either means that I need to rethink what I was
saying, or at least find a way to re-word things to convince others that I'm correct. (Believe it or not, I have
been known to be wrong now and then!)
Scott

Hello again Scott,
ARP seems more like a Layer 3 utility defined at Layer 2
I believe that statement leans towards your argument. But your post did put it into perspective.
I submit, your reasoning does make complete sense.
I can now put the ARP layer question to rest. As stated earlier, I shall be back for ICMP, totally ammoed up!

heheheh... No problems!
!sub-m33T 1,288 posts since Dec 22, 2009
20
I generally prefer to refer to this excellent read, when it comes to trying to map N/W protocols to the OSI-model
layers>>>>
http://imacst.com/web_documents/01_01_4_gallert.pdf
It's a matter of personal taste, not to carelessly {over/under}estimate any of the semantics and underlying
intraworks&relationships of a protocol(or protocol stack) implementation, plz read further if interested (it has
some ARP-specific notes too).
cheers folks
PS: Btw IMHO ARP is L2 OSI-wise, as the scope of the related FF(x6) request broadcast (and its unicast reply)
is surely L2-based&bound (and L3 objects generally refuse to further forward/flood such frames beyond their
respective L2-adjacent/attached intfs, the most replying with their own suitable MAC, if what's asked inside
the request is matching their own L2-adjacent intf's IPconfig or if proxyARP's enabled/cfg'd in-between their
different directly-connected broadcast-domain subnets).

Preet
I get it. People are here to learn. But I was very surprise to see usa-firefly in the post number 44 telling me and
I quote " please, stop confusing others " because he thinks ARP is layer 3 and I think ARP is layer 2.
Is that right to tell me all of that if he disagree with me how I understand ARP protocol?
Let, s move on

in response to Jean
Hello Jean,
I missed USA-firefly's post else I would have rather responded to him/her since that was quite impolite.
Irrespective, I wasn't taking sides, was just making a point.
No hard feelings!
Let's move on......to ICMP Any thoughts on the layer question for ICMP?

21

I've done it the past, and still at at times err. We learn while in the passing. So, yes lets forget about it. All's fine.
John Oliphant 283 posts since Jan 10, 2014

Any thoughts on the layer question for ICMP?
Just one: Where does assigning a function to a layer, such as ARP, help us in the real world? This one seems
to be a test subject more than a useful skill, but I'm ready to be corrected.
FWIW this discussion today reminds me of a typical business meeting. We challenge each other, reach
consensus, then have donuts together and chat about yesterday's ballgame.

Preet D'Souza wrote:
Let's move on......to ICMP Any thoughts on the layer question for ICMP?
Quoting the oldie rfc792
The Internet Protocol (IP) [1] is used for host-to-host datagram service in a system of
interconnected networks called the Catenet [2]. The network connecting devices are called
Gateways. These gateways communicate between themselves for control purposes via a
Gateway to Gateway Protocol (GGP) [3,4]. Occasionally a gateway or destination host will
communicate with a source host, for example, to report an error in datagram processing.
For such purposes this protocol, the Internet Control Message Protocol (ICMP), is used.
ICMP, uses the basic support of IP as if it were a higher level protocol, however,
ICMP is actually an integral part of IP, and must be implemented by every IP module.
HTH you indeed m8 on the actual intentions of the std/spec authors.
Similarly http://tools.ietf.org/html/rfc4443>>>>
ICMPv6 (ICMP for IPv6)
22
ICMPv6 is used by IPv6 nodes to report errors encountered in processing packets, and
to perform other internet-layer functions, such as diagnostics (ICMPv6 "ping"). ICMPv6 is
an integral part of IPv6, and the base protocol (all the messages and behavior required by
this specification) MUST be fully implemented by every IPv6 node.
cheers

in response to !sub-m33T
Spot on with the RFCs.
Now something more practical, like wireshark packet captures?

in response to John Oliphant
Hello John,
Once knowldge in networking reaches a significant level of 'comfort', one ofcourse tends to avoid or simply
brush aside questions pertaining to the layering models. However, my take on it is that, if the subject or any
subject for that matter has to be mastered, the teaching part also comes becomes a necessity. What we learn
should be transmissible onto others (students) and the layering models are created precisely for that, to help
understand and spread this understanding based on certain concepts. Is it any wonder then why the OSI and
TCP/IP models are even stressed on in foundation networking courses?

in response to John Oliphant
Someone brought donuts?!?!?!?!

On a side note though, it IS important to get a firm grasp of the basics. You'd be surprised how many people
do not. And the more you know about the basic stuff, he less surprised you'll be when learning new things.
There are LOTS of similarities and repetition of things there are between different protocols or technologies!
23
Fabiola
Great resource !sub-m33T! Thanks for sharing!

Spot on with the RFCs.

Now something more practical, like wireshark packet captures?
Naaaahh I prefer this>>>>
and the link I provided on post #59.
The encapsulation within IP (or the existence of IP proto number==1, and a relevant header) doesn't mean it's
an upper-layer protocol (eg TCP/UDP). Look for the same encapsulation on EIGRP/OSPF(IP proto# 88, 89
respectively) or IPsec protocols(ESP/AH-->50,51). Wouldn't you classify those as example L3 protocols????
There's also the debatable IGMP(2) and GRE(47). L2TPv3oIP also uses an IP Header and has a respective
protocol number (115). Where should one place OSI-wise the L2TPV3 protocol/tunnels?
cheers dear bro I really enjoy the discussion

24
in response to Fabiola
Fabiola wrote:
Great resource !sub-m33T! Thanks for sharing!
Dear Fabi, my honest pleasure, are you referring to the pdf on #59?
Yep, I really appreciated finding that one.
If you are referring to the rfcs(#64), I think these are vital resources towards painful theory (and applicable
scope) understanding, beyond a certain industry exposure level. You just can't "live" without referencing them
cheers Fabiola
Message was edited by: !sub-m33T-->"In response to..." link on Fabi's original post(#69) clarifies what is the
mentioned resource, hence the strikethrough

Build the frame and the packet in your head, and follow it everywhere.

The article you posted was indeed informative, but to individuals who have already studied and attempted
classification of networking protocols according to the layered models, the points mentioned are nothing 'new'.
The networking models are important from a beginner's perspective wherein ARP and ICMP actually do fall
under the category of 'basic' under today's networking fundamentals. We arrange them according to layers in
order to present a simplistic view of an otherwise complicated technology and not to make strict categorizations
based on tedious approaches or methods. This aids in helping people take up and eventually gain a sturdy
foundation in the subject of networking.
In conclusion, the network layer concepts can be considered to be highly important and yet simplistic tools to
teach the subject.

in response to sarah
Yeah, Sarah.. I know, I know.
However, the topic being discussed here is related to networking fundumentals. That's not something that you
can get from experience.
25
You learn it for once. And you can learn it wrong. Then you get yourt CCIE, get lots of experience, and.. well
people tend to believe you because you are CCIE, right?
If I'm wrong and I know it, I just admit it.

I'm not convinced so far.
But I can tell you why this discussion takes place. Simply because the original RFC 826, where ARP is defined,
does not mention what OSI Layer ARP belongs to. That's why different people have different opinions. And
there's no to way to determine who is right and who is wrong.
However, Wendell Odom in his OCG states that ARP is Layer 3 protocol.
I believe him.
Although I have to admit that I need to do some more research on this topic.
Thank you,
USA_firefly
Fabiola
Yes !sub-m33T I was referring to post #59. Have a nice day!

Hi, Scott,
Hands up! You are right.

ARP works on Layer 2 of OSI model.
I guess I just got confused by my study guide.
It's always better to trust people with experience.
My sincere apologies.
Best regards,
USA_firefly

in response to Jean
26
Hi, Jean,
I'm sorry, didn't mean to offend you.

We are here to learn.
Today I learned my lesson the hard way.
But at least I did it.
My sincere apologies.
Regards,
USA_firefly

Note to everyone reading this thread:
We agreed that ARP belongs to Layer 2 and ICMP belongs to Layer 3.
To biplab:
Your question is answered.
Regards,
USA_firefly

in response to sarah
Yes, Sarah. Same pitfalls, same pitfalls..

LOL!! Yes, I see it. Don't worry about it. It's a part of the learning phase. Been there, done that...ooopsie.

27
The article you posted was indeed informative, but to individuals who have already
studied and attempted classification of networking protocols according to the layered
models, the points mentioned are nothing 'new'.
The networking models are important from a beginner's perspective wherein ARP and
ICMP actually do fall under the category of 'basic' under today's networking fundamentals.
We arrange them according to layers in order to present a simplistic view of an otherwise
complicated technology and not to make strict categorizations based on tedious approaches
or methods. This aids in helping people take up and eventually gain a sturdy foundation in
the subject of networking.
In conclusion, the network layer concepts can be considered to be highly important
and yet simplistic tools to teach the subject.
Thank you m8, credit goes to the author of course! IMO it validly stresses the fallacies and oddities of trying to
carelessly define an exclusive 1-1 mapping between protocols(and protocol stacks) and the OSI layer scheme.
I concur to 5nines of what you say above my friend, my only addition would be>>>>
OSI model holds IMHO some additional, valuable Modular-Layering-Framework benefits, apart from
facilitating easier mental-maps for learning/teaching:
Conceptual understanding and correct practical implementations of the data-encapsulation/

decapsulation process and other transformation(encryption, compression etc) mechanics from the
top-down to the bottom-up of information exchange.
Error/Fault-domain separation&containment(easier tshooting, less complexity)
Component reuse and tons of wonderful combinations and user-domain apps/services (eg IPoEth,
IPoATM, PPPoE/PPPoA, MPoA, AToM, FRoEth, IPoMPLS, VPLS, TCP/IPoTR, WiFi/WiMAX, VoIP,
VoWLAN, TCP/UDPoIPX, NBT, L2TPv3oIP, IPv6, IPsec, <APPS>oTLS, VPNs, SSH-app-tunneling
etc just to name a few)
Component Standardization & VENDOR INTEROPERABILITY
cheers and thank you for this gr8 discussion

1 2 3 Previous Next
28

Arp N Icmp

Transféré par

Informations du document

Titre original

Copyright

Formats disponibles

Partager ce document

Partager ou intégrer le document

Options de partage

Avez-vous trouvé ce document utile ?

Ce contenu est-il inapproprié ?

Droits d'auteur :

Formats disponibles

Arp N Icmp

Transféré par

Droits d'auteur :

Formats disponibles

ARP and ICMP Which layers??

biplab 16 posts since Jun 8, 2011

Helder Neves 353 posts since Jun 17, 2011

biplab 16 posts since Jun 8, 2011

Scott Morris - CCDE/4xCCIE/2xJNCIE 8,435 posts since Oct 7, 2008

Helder Neves 353 posts since Jun 17, 2011

Whats your opinion?

Garri 111 posts since Jun 20, 2011

Message was edited by: Garry

biplab 16 posts since Jun 8, 2011

Garri 111 posts since Jun 20, 2011

Scott Morris - CCDE/4xCCIE/2xJNCIE 8,435 posts since Oct 7, 2008

All the joys.

biplab 16 posts since Jun 8, 2011

Garri 111 posts since Jun 20, 2011

Bikas Pandey 47 posts since Jan 4, 2011

Elvin Arias 2,585 posts since Mar 12, 2010

Garri 111 posts since Jun 20, 2011

Vijay Swaminathan 491 posts since Aug 29, 2008

OSPF at Data Link Layer ?? I really doubt.

Garri 111 posts since Jun 20, 2011

Garri 111 posts since Jun 20, 2011

More detailed information about TCP/IP Link layer definitions

Brian 2,971 posts since Aug 17, 2009

Hope this helps.

reamea7 2 posts since Aug 14, 2011

jneiberger 465 posts since Jun 10, 2010

jneiberger 465 posts since Jun 10, 2010

Sorry if this just adds to the confusion.

reamea7 2 posts since Aug 14, 2011

Annamalai 734 posts since Jan 1, 2011

ICMP is a Layer3 protocol. Not sure who said it was Layer2.

Shocken85 3 posts since Jul 23, 2013

Sorry if I added confusion, but I, myself, am

Brad 327 posts since Aug 8, 2012

jneiberger 465 posts since Jun 10, 2010

Shocken85 3 posts since Jul 23, 2013

Thanks for the replies,

jneiberger 465 posts since Jun 10, 2010

Brian 2,971 posts since Aug 17, 2009

Shocken85 3 posts since Jul 23, 2013

Thanks for the contributions to this question.

stardust 206 posts since Jan 4, 2010

Juraj 1 posts since Oct 9, 2013

Please correct me if I am wrong

Preet D'Souza 14 posts since Aug 6, 2014

USA_firefly 100 posts since Jul 15, 2014

I'm studying for CCENT and using Odom's book.

I'm sorry, guys. Didn't read the book correctly.

Message was edited by: USA_firefly

Scott Morris - CCDE/4xCCIE/2xJNCIE 8,435 posts since Oct 7, 2008

Re: ARP and ICMP Which layers?? Aug 6, 2014 10:30 PM

Preet D'Souza 14 posts since Aug 6, 2014

USA_firefly 100 posts since Jul 15, 2014

I'm sorry but I have to disagree with you.

Both ARP and ICMP work on Layer 3 of OSI model.

We cannot this too much about it

Message was edited by: USA_firefly

Jean 119 posts since May 10, 2014

USA_firefly 100 posts since Jul 15, 2014

Please, stop confusing other people.

Good luck with your studies.

Jean 119 posts since May 10, 2014