Troubleshooting

OSI Layers 13

In this two-part white paper series, learn to quickly locate and resolve problems across the
OSI layers using the Troubleshooting Cheat Sheet.

User complaints never come at an opportune time. You are already

!$%!#
being pulled in 20 directions when a user complains of slow Internet
!$%!#
or email access. With few details and limited time to solve the
problem, its easy to overlook sound troubleshooting practices. !$%!#

Not sure where to begin? The easiest place to start is by

understanding as much as you can about the users experiences.
Mike Motta, NI University instructor and troubleshooting expert,
places the typical user complaints into three categories: Slow Top 3 user complaints
Network, Inability to Access Network Resources, and Application-
Specific Issues. Based upon the answers to the questions outlined
Slow network
in the following Troubleshooting Cheat Sheet, youll gain a better
understanding of the symptoms and be able to isolate the issue to
Inability to access network resources
the correct layer of the Open Systems Interconnection (OSI) model.
Application-specific issues
Then you can begin troubleshooting.

White Paper
 Complaint What to Ask What it Means

Slow Network What type of application is being used? Is it web- Determines whether the person is accessing local or
based? Is it commercial, or a homegrown application? external resources.

How long does it take the user to copy a file Verifies they can send data across the network to a server, and
from the desktop to the mapped network drive allows you to evaluate the speed and response of the DNS Server.
and back?

How long does it take to ping the server Validates they can ping the server and obtain the response time.
of interest?

If the time is slow for a local server, how many Confirms the number of hops taking place. Look at switch and
hops are needed to reach the server? server port connections, speed to the client, and any errors.

Inability to What task is the user attempting to perform? Indicates whether the action is limited to a specific resource such
Access Net- as a mapped drive on a server or multiple network resources.
Work
Resources What type of application is the user attempting Similar to the above question on application type, this may point
to access? to a problem with multiple internal servers.

Application- Whats the 3-way handshake time? Identifies potential points where a slowdown might
Specific Issues be occurring.

Whats the server processing time? Points to whether the server is taking too long to
process data.

How much data are you pulling from the Assesses whether the application is sending data in an expected
application and sending across the network? and efficient way.

For additional information on application-specific issues, check out Mike Mottas Tech Tips.

Getting Started: The First 3 Layers

With these questions answered, working through the OSI model is Data Link Layer
a straightforward process. With the exception of Layer 1, each layer Converts signals into bits which become the packet data that
of the OSI model relies on the next lower layer to provide services everyone wants
as specified. Requests drop down and are completed, as every layer
Performs error detection and correction of the data streams
interacts with the next layer, both above and below.
Manages flow and link control between the physical signaling
When dealing with different layers, understanding how each delivers
and network
data and functions impacts how you will troubleshoot.
Constructs and synchronizes data frame packets

Layer Highlights and Functions Network Layer

Logical addressing, routing, and packet generation
Physical Layer
If it can blind or shock you, think Physical Layer Carries out congestion control and error handling

Defines physical characteristics of cables and connectors Route monitoring and message forwarding

Provides the interface between network and network devices

Describes the electrical, light, or radio data stream signaling

2 Troubleshooting OSI Layers 13

challenge is applications that rely on ICMP for notification may fail
without warning.

Getting Started: The First 3 Layers

With these questions answered, working through the OSI model is
a straightforward process. With the exception of Layer 1, each layer
of the OSI model relies on the next lower layer to provide services
as specified. Requests drop down and are completed, as every layer
interacts with the next layer, both above and below.

When dealing with different layers, understanding how each delivers

data and functions impacts how you will troubleshoot.

Physical-layer tool box

Layer Highlights and Functions
Physical Layer Network analyzer
If it can blind or shock you, think Physical Layer
Defines physical characteristics of cables and connectors Snmp poller
Provides the interface between network and network devices
Describes the electrical, light, or radio data stream signaling Cable tester
Data Link Layer
Converts signals into bits which become the packet data that as a cable pinched in a door. Thirty percent of the issues I fix are a
everyone wants
result of me going for a walk, he said.
Performs error detection and correction of the data streams
The next step in investigating Physical Layer issues is delving into
Manages flow and link control between the physical signaling
and network performance problems. Its not just dealing with more complex issues,
but also having the correct tools to diagnose degraded performance.
Constructs and synchronizes data frame packets
For example, if youre diagnosing an issue with slow email being
Network Layer caused by a physical issue, you need to have statistics enabled on
Logical addressing, routing, and packet generation the network equipment. That allows you to find physical-level errors,
such as CRC or alignment errors that indicate performance problems.
Carries out congestion control and error handling
Then, confirm your analysis tools can view those errors either via
Route monitoring and message forwarding
packet capture with a TAP or SNMP polling.

Lets Get Physical Assessing Physical Performance Errors

Generally speaking, Physical Layer symptoms can be classified
When using a network analyzer capable of capturing packets with
into two groups of outage and performance issues. In most cases,
CRCs to diagnose performance issues, you may notice that the
investigating outage issues is the easiest place to begin, as its
errors generated can point you in the direction of whats causing the
a matter of confirming the link light is out or that a box is not
Physical Layer problem. As a result, these errors can be divided into
functioning. Additionally, validating equipment failure is a matter of
intelligent and non-intelligent errors.
replacing the cable or switch and confirming everything works.
Intelligent Errors:
I cant tell you how many Physical Layer issues are overlooked by An intelligent host is smashing into your network signal and
people pinging or looking at NetFlow for the problem, when in reality corrupting the data.
its a Layer 1 issue caused by a cable, jack, or connector, said Tony Example: Overloaded WiFi network or a busy channel.
Fortunato, Senior Network Performance Specialist and Instructor with
Non-Intelligent Errors:
the Technology Firm.
An outside entity is causing noise that interferes with the signal
I jokingly tell analysts if you are close to the problem, its time to take or flow of data across the network.
a walk and take a look at the cables. Be sure the issue isnt as simple Example: A microwave interfering with a WiFi signal.

3 Troubleshooting OSI Layers 13

 1 0 1
Understanding Cabling Specifications

1 0
0
As cabling is essentially the heart of the Physical Layer, a simple rule

0 0
of thumb is - When in doubt, start with your cables. The following
characteristics are critical to understand when investigating:

Link Activation and Deactivation 1

This is the green light that should appear when you plug your computer
into the switch. Although a good start, it doesnt mean there isnt a
cabling issue. When you see the green light, youre verifying the ability
to receive a signal but not to transmit.

Voltage Levels
When plugging a copper cable into a switch, verify there is enough
voltage to support data flow. If you have the wrong type of cable or Application, server, and driver
too long of a run, voltage levels may be reduced to the point that you
wont receive a link light.
patches and updates are known
culprits for knocking the packet
If the link light sporadically turns on and off, this could be a sign
of marginal voltage strength. Whether building your own cables or size down unbeknownst to the
purchasing from a reputable manufacturer always test
cable integrity. network engineer.
Data Rates
Data rate specifications for 1 Gb, 10 Gb, and 40 Gb require different
cables (cat 5e or cat 6). Even though you may connect a cat 6 cable
between computer and wall, verify that the cabling behind the wall is
also up to specification.

Its the same thing with wireless classifications of 802.11 a/b/g/n/ac,

which correspond to the strength and/or quality of the signal. View
these as suggested speeds rather than what will be achieved. Many
variables can prevent the signal from reaching
the advertised data rate.

Maximum Transmission Unit (MTU)

MTU defines how big your packets can be. If youre not using
the maximum size, then network efficiency will be impacted.
Verify that packet size is optimized.

Application, server, and driver patches and updates are known

culprits for knocking the packet size down unbeknownst to the
network engineer.

Damage to or misconfiguration of any of the Physical Layer

components can affect connectivity at every layer. Additionally,
these problems can easily be misdiagnosed for upper-layer issues.
A good understanding and review of Physical Layer concepts will
prevent a lot of troubleshooting headaches down the road.

4 Troubleshooting OSI Layers 13

Data Link Layer and Sub-Layers
10
01
Data Link is the second layer of the OSI model and is comprised of

1
two sub-layers -- the Logical Link Control (LLC) Layer and Media

0
Access Control (MAC) Layer.

LLC: Interprets electricity, light, and WiFi into ones and zeros,
which become the data packets.

MAC: Responsible for moving data packets to and from one

Network Interface Card (NIC) to another across a shared
channel. The sublayer uses MAC protocols to ensure that
signals sent from different stations across the same channel
dont collide.

The easiest way to understand the Data Link Layer and the role of
MAC is to think of a Layer 2 switch, said Fortunato. Layer 2 doesnt
deal with bits, rather it deals primarily with addresses represented
by the MAC Layer. With every device having a MAC address, the Did You Know?
sole concern of the Layer 2 switch is understanding how data gets
from Port A to Port B. The switch has a table with two pieces of
information the address and the port. And thats it.
If cabling isnt causing the problem,
analyzers such as Wireshark or the
Observer Analyzer can be used to
view the individual frames taken
from the media to locate anomalies.
Software-based analyzers relying on
a standard network adapter may be
unable to detect MAC layer errors.

As displayed in the Observer Analyzer, Common Layer 2 errors include CRC,

Alignment, Too Small, and Too Large.

5 Troubleshooting OSI Layers 13

 Due to security concerns, some organizations turn off ICMP. T
cations that rely on ICMP for notification may fail without war

Corrupted Packet Flooding

Its critical for the switch to know what ports youre on. If this is
incorrect, this can directly impact network performance. This is easy to
spot when MAC addresses change due to a corrupt or errant packet.
For example, if the known MAC address for the client is A-A-A but a
corrupt packet reports the MAC address as A-A-1, the Layer 2 switch
can respond in two ways:

1) If the packet is changed due to an error, it will trigger a CRC error

and the switch drops the packet.

2) The switch isnt configured to check for errors, it simply passes

Be Aware
the packet along and attempts to resolve the issue. Without
knowing where the MAC address goes, it sends a copy of the Due to security concerns, some
packet to every port on that subnet or VLAN. The end result is
that network engineers waste a long time locating the source of
organizations turn off ICMP. The
this packet flooding. challenge is applications that rely
Flooding from MAC Misconfigurations
on ICMP for notification may fail
The second common issue at the Data Link Layer is flooding due to
without warning.
MAC misconfiguration issues. If a server has two cards to handle load
balancing or failover, some of the protocols used will change the server
MAC address. In this case, both cards have a single shared imaginary
MAC address established by the server. This can also result in packet
flooding, if the switch doesnt know where the MAC address belongs.

I saw this type of flooding occur on a healthcare organizations

network I was troubleshooting, said Fortunato. I plugged my analyzer
into a common switch port, and proceeded to capture over 800
megabytes of data on a regular port. I thought it was a SPAN port,
but the engineer informed me it was a normal port. This is common
with switches, firewalls, routers or load balancers, where two NICs are
sharing the same MAC address on a single device.

When you are implementing load balancing, verify with the

manufacturer that the switch handles the specific type of load
balancing being utilized and how to correctly configure the device.
Although many switches are capable of learning and tuning to
support load balancing, by default they may not be set up properly
which results in flooding causing an unexplained network crash.

6 Troubleshooting OSI Layers 13

Network Layer Problems
Both the Network and Data Link Layers are involved in aspects
of data delivery, and understanding how each layer delivers data
impacts troubleshooting. Where the Data Link layer is represented by
the Layer 2 switch, the Network Layer is represented by a router. In
routing data, the router is sending data packets to the network where
the destination or end-point resides. Using mail delivery as an analogy,
the router is reading the equivalent of your zip or postal code and
Use Observer Analyzer to view ICMP messages and investigate routing
sending it to the local post office.
errors, the network path, and potentially failing devices.
Its the switch with a table of MAC addresses and ports that delivers
the data to the destination (host or user). This is similar to the mail
carrier bringing a letter from the local post office to your house. In addition to routing-related messages, another ICMP message to
consider while troubleshooting the Network Layer is an indication of
Typically, in the Network layer, the problems are going to be
incorrect packet size. The protocol is changing the size of the packets to
routing problems,says Mike Motta. Routes to nowhere. Wrong
make things work, but when it cant, it sends an error message stating:
subnet masks, wrong default gateways, are the kinds of things that
I typically find. Fragmentation required, but the Do Not Fragment Bit is set.
Fragmentation is required.
Finding the source of problems in the Network Layer requires
smarter tools. Using some of the built in tools that devices have It also displays the appropriate packet size that should be sent.
like ping and traceroute, and a protocol analyzer like Observer Network analysis tools pick up the proper size and may report this
Analyzer is a good place to start. Typically youre looking for ICMP message. If proper packet size isnt achieved, the application will
(Internet Control Message Protocol) messages coming back from either drop the packets or disconnect.
the router telling you if theres a better route to get where youre
trying to reach, ICMP redirects, telling you about wrong masks, Conclusion
things like that. The routers are sometimes smart enough to help us
out if you know how to use a protocol analyzer. For faster troubleshooting at any layer, begin with a solid
understanding of how the issue affects the user. Using the right
ICMP messages coming back from the router will tell us of wrong performance management tools along with the OSI model, youll be
masks, wrong default gateways, wrong routes and route tables, able to more effectively apply analysis and identify root cause.
says Motta. Use the packets to look for ICMP messages. Also did
the frame go to the right MAC address of the router or did it go to a
different MAC address, or MAC address of a different router? These
are all questions to ask.

Contact Us +1 844 GO VIAVI 2015 Viavi Solutions Inc.

(+1 844 468 4284) Product specifications and descriptions in this
document are subject to change without notice.
To reach the Viavi office nearest you, troubleshootingosilayers13-wp-ec-ae
visit viavisolutions.com/contacts. 30176217 901 0315

viavisolutions.com