• Advertisement

whats a LOOP traffic in ethereal?

VTP, Portfast, Spanning Tree and all the other switch related stuff.

Re:whats a LOOP traffic in ethereal?

Postby Guest » Sun Jan 02, 2011 12:44 pm

Thanks Giuseppe, my teacher .

 

but i have a question about your comment.

 

in your saying

 

the frame is sent out on the wire, whoever is on other side of the cable by seeing ethertype 0x9000 sends back the frame.

 

 

but i can find the reply frame in the captured file.

 

if, as your explanation,

A(00:1a:6c:fe:49:80) must be receive for the keepalive frame it sent from other device.

but ethereal file shows just sending file.

 

there is no receiving frame from other device.

 

could you explain this more detail??

Guest
 

Advertisement

Re:whats a LOOP traffic in ethereal?

Postby Guest » Sun Jan 02, 2011 1:08 pm

Giuseppe,

 

Are you sure about this? I have never seen any device, be it a Cisco box, a Linux/Windows machine or any other Ethernet-capable node to actually send back a received LOOP frame. Moreover, I believe that a Cisco switch actually uses these LOOP frames to detect a self-looped port (all other loops are eliminated by STP) and so it expects not to receive the LOOP frame back.

 

If the LOOP frame was supposed to be received back, what would be the action if it was not received back? All switchports send the LOOP frames but the end stations - Windows, Linux - do not bother reflecting them back.

 

I have to confirm my suspicion in a lab in a few hours but for now, I somehow do not see how the LOOP frames are useful if they are not used for self-looped port detection.

 

Best regards,

Peter

Guest
 

Re:whats a LOOP traffic in ethereal?

Postby Guest » Sun Jan 02, 2011 1:55 pm

Hello Peter,

this is my current understanding of ethernet keepalive.

 

if I take an Rj-45 ethernet port for example an ethernet of a PA 4E and i leave it unplugged the interface is down/down

If with the port unplugged I disable keepalive (no keepalive under interface config) the ports  comes up and it is even pingable (because when pinging an ethernet interface the packet is not sent out on the wire like it happens with serial or ATM interfaces).

Ethernet interfaces have no carrier to be detected and no TDM framing to be detected.

 

My first idea was that keepalive frames were sent out with MAC SA= router NIC MAC and MAC DA= broadcast.

 

Ive done some searches and most of links point to the following:

 

http://www.mit.edu/~jhawk/ctp.pdf

 

http://lwn.net/Articles/330797/

 

ECTP packets can be sent to unicast, broadcast, or the ECTP reserved
+       cf:00:00:00:00:00 multicast address

 

 

>> If the LOOP frame was supposed to be received back, what would be the action if it was not received back?

see above to consider the port down

 

the fact that receving back its own keepalive frames is a sign of a loop for me is related to a famous bug on C3750 and other switches on fiber based ports where the suggested workaround was to disable keepalive on those ports.

This bug has been discussed in several threads in the forums.

 

It is reasonable that if the  objective is to test capability to send and receive ethernet frames a test with a frame sent out on wire and then received back would be the most meaningful.

 

 

Sanghee:

http://wiki.wireshark.org/Loop

 

We are speaking of something so basic, that received frames could be simply ignored and not passed to upper layers as suggested in above documents. I will look again at how you did your tests.

 

Im ready to change my mind again about this as I did several times in the past.

 

 

Hope to help

Giuseppe

Guest
 

Re:whats a LOOP traffic in ethereal?

Postby Guest » Sun Jan 02, 2011 2:26 pm

Giuseppe,

 

This is going to be a long post. Please bear with me...

 

First, the results of my lab experiment. I have tested the behavior of 2950, 2960 and 3560 series switches to a looped port. The switch under test was connected via Fa0/1 to a hub (for sniffing purposes) and the hub was subsequently connected to another switch whose other two ports were intentionally connected together, creating a loop. If the switch under test sent a frame via its Fa0/1 port, it arrived at the second switch, looped and returned back. I watched for the frame reflection on the hub and observed the behavior of the switch under test.

 


 

The 2950 switch was running C2950 Software (C2950-I6K2L2Q4-M), Version 12.1(22)EA13. The switch was booted with its configuration completely erased, and was initially configured using these commands:

 

no cdp run
Guest
 

Re:whats a LOOP traffic in ethereal?

Postby Guest » Sun Jan 02, 2011 3:01 pm

Hello Peter,

your results are interesting and show a behaviuor near to your description at least on Cisco LAN switches

I had found some papers that were comforting my idea of keepalive but your tests are clear.

 

Ad yes thosePA 4E ethernet ports if unplugged were up/down forgive me Im at home for a sick leave and it was ten years ago.

 

I need some young brilliant mind like yours to keep on track.

 

 

Hope to help

Giuseppe

Guest
 

PreviousNext


  • Advertisement


Similar topics


Return to Cisco Switching

Who is online

Users browsing this forum: No registered users and 1 guest