Linux Networking Utilities for Arista EOS- Part 1

Linux Networking Utilities for Arista EOS 

LINUX NETWORKING UTILITIES:

.

Ifconfig:

• ifconfig in short “interface configuration” utility for system/network administration in Unix/Linux operating systems to configure, manage and query network interface parameters via command line interface or in a system configuration scripts.
• The “ifconfig” command is used for displaying current network configuration information, setting up an ip address, netmask or broadcast address to an network interface, creating an alias for network interface, setting up hardware address and enable or disable network interfaces.
• 1. View All Network Setting

• The “ifconfig” command with no arguments will display all the active interfaces details. The ifconfig command also used to check the assigned IP address of an server.

[root@tecmint ~]# ifconfig eth0      Link encap:Ethernet  HWaddr 00:0B:CD:1C:18:5A inet addr:172.16.25.126  Bcast:172.16.25.63  Mask:255.255.255.224 inet6 addr: fe80::20b:cdff:fe1c:185a/64 Scope:Link UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1 RX packets:2341604 errors:0 dropped:0 overruns:0 frame:0 TX packets:2217673 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:293460932 (279.8 MiB)  TX bytes:1042006549 (993.7 MiB) Interrupt:185 Memory:f7fe0000-f7ff0000 lo        Link encap:Local Loopback inet addr:127.0.0.1  Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING  MTU:16436  Metric:1 RX packets:5019066 errors:0 dropped:0 overruns:0 frame:0 TX packets:5019066 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:2174522634 (2.0 GiB)  TX bytes:2174522634 (2.0 GiB) tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:10.1.1.1  P-t-P:10.1.1.2  Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

• 2. Display Information of All Network Interfaces

• The following ifconfig command with -a argument will display information of all active or inactive network interfaces on server. It displays the results for eth0, lo, sit0 and tun0.

[root@tecmint ~]# ifconfig -a eth0      Link encap:Ethernet  HWaddr 00:0B:CD:1C:18:5A inet addr:172.16.25.126  Bcast:172.16.25.63  Mask:255.255.255.224 inet6 addr: fe80::20b:cdff:fe1c:185a/64 Scope:Link UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1 RX packets:2344927 errors:0 dropped:0 overruns:0 frame:0 TX packets:2220777 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:293839516 (280.2 MiB)  TX bytes:1043722206 (995.3 MiB) Interrupt:185 Memory:f7fe0000-f7ff0000 lo        Link encap:Local Loopback inet addr:127.0.0.1  Mask:255.0.0.0 inet6 addr: ::1/128 Scope:Host UP LOOPBACK RUNNING  MTU:16436  Metric:1 RX packets:5022927 errors:0 dropped:0 overruns:0 frame:0 TX packets:5022927 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:2175739488 (2.0 GiB)  TX bytes:2175739488 (2.0 GiB) sit0      Link encap:IPv6-in-IPv4 NOARP  MTU:1480  Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:0 RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b) tun0      Link encap:UNSPEC  HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00 inet addr:10.1.1.1  P-t-P:10.1.1.2  Mask:255.255.255.255 UP POINTOPOINT RUNNING NOARP MULTICAST  MTU:1500  Metric:1 RX packets:0 errors:0 dropped:0 overruns:0 frame:0 TX packets:0 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:100 RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

• 3. View Network Settings of Specific Interface

• Using interface name (eth0) as an argument with “ifconfig” command will display details of specific network interface.

[root@tecmint ~]# ifconfig eth0 eth0      Link encap:Ethernet  HWaddr 00:0B:CD:1C:18:5A inet addr:172.16.25.126  Bcast:172.16.25.63  Mask:255.255.255.224 inet6 addr: fe80::20b:cdff:fe1c:185a/64 Scope:Link UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1 RX packets:2345583 errors:0 dropped:0 overruns:0 frame:0 TX packets:2221421 errors:0 dropped:0 overruns:0 carrier:0 collisions:0 txqueuelen:1000 RX bytes:293912265 (280.2 MiB)  TX bytes:1044100408 (995.7 MiB) Interrupt:185 Memory:f7fe0000-f7ff0000

• 4. How to Enable an Network Interface

• The “up” or “ifup” flag with interface name (eth0) activates an network interface, if it is not in active state and allowing to send and receive information. For example, “ifconfig eth0 up” or “ifup eth0” will activate the eth0interface.

[root@tecmint ~]# ifconfig eth0 up OR [root@tecmint ~]# ifup eth0

• 5. How to Disable an Network Interface

• The “down” or “ifdown” flag with interface name (eth0) deactivates the specified network interface. For example, “ifconfig eth0 down” or “ifdown eth0” command deactivates the eth0 interface, if it is in active state.

[root@tecmint ~]# ifconfig eth0 down OR [root@tecmint ~]# ifdown eth0

• 6. How to Assign a IP Address to Network Interface

• To assign an IP address to an specific interface, use the following command with an interface name (eth0) and ip address that you want to set. For example, “ifconfig eth0 172.16.25.125” will set the IP address to interface eth0.

[root@tecmint ~]# ifconfig eth0 172.16.25.125

• 7. How to Assign a Netmask to Network Interface

• Using the “ifconfig” command with “netmask” argument and interface name as (eth0) allows you to define an netmask to an given interface. For example, “ifconfig eth0 netmask 255.255.255.224” will set the network mask to an given interface eth0.

[root@tecmint ~]# ifconfig eth0 netmask 255.255.255.224

• 8. How to Assign a Broadcast to Network Interface

• Using the “broadcast” argument with an interface name will set the broadcast address for the given interface. For example, “ifconfig eth0 broadcast 172.16.25.63” command sets the broadcast address to an interface eth0.

[root@tecmint ~]# ifconfig eth0 broadcast 172.16.25.63

• 9. How to Assign a IP, Netmask and Broadcast to Network Interface

• To assign an IP address, Netmask address and Broadcast address all at once using “ifconfig” command with all arguments as given below.

[root@tecmint ~]# ifconfig eth0 172.16.25.125 netmask 255.255.255.224 broadcast 172.16.25.63

• 10. How to Change MTU for an Network Interface

• The “mtu” argument set the maximum transmission unit to an interface. The MTU allows you to set the limit size of packets that are transmitted on an interface. The MTU able to handle maximum number of octets to an interface in one single transaction. For example, “ifconfig eth0 mtu 1000” will set the maximum transmission unit to given set (i.e. 1000). Not all network interfaces supports MTU settings.

[root@tecmint ~]# ifconfig eth0 mtu 1000

• 11. How to Enable Promiscuous Mode

• What happens in normal mode, when a packet received by a network card, it verifies that the packet belongs to itself. If not, it drops the packet normally, but in the promiscuous mode is used to accept all the packets that flows through the network card.
• Most of the today’s network tools uses the promiscuous mode to capture and analyze the packets that flows through the network interface. To set the promiscuous mode, use the following command.

[root@tecmint ~]# ifconfig eth0 promisc

• 12. How to Disable Promiscuous Mode

• To disable promiscuous mode, use the “-promisc” switch that drops back the network interface in normal mode.

[root@tecmint ~]# ifconfig eth0 -promisc

• 13. How to Add New Alias to Network Interface

• The ifconfig utility allows you to configure additional network interfaces using alias feature. To add alias network interface of eth0, use the following command. Please note that alias network address in same sub-net mask. For example, if your eth0 network ip address is 172.16.25.125, then alias ip address must be 172.16.25.127.

[root@tecmint ~]# ifconfig eth0:0 172.16.25.127

• Next, verify the newly created alias network interface address, by using “ifconfig eth0:0” command.

[root@tecmint ~]# ifconfig eth0:0 eth0:0    Link encap:Ethernet  HWaddr 00:01:6C:99:14:68 inet addr:172.16.25.123  Bcast:172.16.25.63  Mask:255.255.255.240 UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1 Interrupt:17

• 14. How to Remove Alias to Network Interface

• If you no longer required an alias network interface or you incorrectly configured it, you can remove it by using the following command.

[root@tecmint ~]# ifconfig eth0:0 down

• 15. How to Change the MAC address of Network Interface

• To change the MAC (Media Access Control) address of an eth0 network interface, use the following command with argument “hw ether“. For example, see below.

[root@tecmint ~]# ifconfig eth0 hw ether AA:BB:CC:DD:EE:FF

Advanced Event Management on Arista EOS

Advanced Event Management

• Proactive tools include Event Manager and the Scheduler; which focus on automation.  Both tools enable scripted actions to take place in response to a pre-defined trigger.  
• When leveraged alongside SYSDB and the wealth of Linux tools that can be run on an the EOS platform, the user is offered the capability to trigger actions on virtually any aspect of system state, all without the requirement for real time user input !

Event Manager:

• Event Manager provides a platform to enable automation of actions in response to pre-defined event triggers.  
• It allows the creation of an event, the definition of under which circumstances the event should trigger and what action should occur in such a situation.
• See the below link for complete details and configuration guide: https://eos.arista.com/introduction-to-managing-eos-devices-automation-and-extensibility/
• Once an event has been triggered the configured action will be executed, this action will be initiated natively from the Linux bash shell, which means the action is not limited by the EOS CLI syntax, but rather any function or action achievable natively in the Linux bash shell.  Typical examples of actions would be to call a file, call a script, execute a native bash command or even EOS CLI commands.

• Call a bash script – action bash /mnt/flash/EmailOnLinkDown
• Call a python script to run as a daemon – action bash daemonize /mnt/flash/IntfMonitor
• Execute a single CLI command, which sends an IM to all Network admins – action bash FastCli -p15 -c ‘xmpp send NetworkAdmins command Interface Ethernet1 is down’
• Execute a series of CLI commands, which bring down a particular interface – action bash FastCli -p15 -c $’conf\n interface ethernet2\n shut’

Email Client Configuration in EOS:

• See given link: https://eos.arista.com/email-client-configuration-on-arista-switches/ 
• Once Email Client has been configured, emails can be used along with event-handler to send emails (either via CLI or bash)

Scheduler:

• While the Advance Event Manager enables actions based on complex triggers, the scheduler provides a similar functionality to repetitive time based triggers.
• The major addition to the Scheduler is that it captures the standard output of an action to a gzipped file in flash, and enables the user to configure how many of these files they wish to keep at any one time.
• To create a scheduled job, a user simply defines how often a task should run, how many log files it should store, and what the job should be.
• Unlike Event-manager, this command is executed natively in EOS, however by prepending the ‘bash’ argument   we can execute bash commands and call scripts, for example ‘command bash /mnt/flash/ConfigBackup’.
• By default EOS has a scheduled task configured to collect a show tech every 60 minutes and store up to 100 instances of the show tech, ensuring that following an issue we have both the pre and post issue data that we need to assist with analysis.

switch#show run all | grep schedule
schedule tech-support interval 60 max-log-files 100 command show tech-support

---

ACL / Access Control Lists

• To see existing IP access lists: #show ip access-list
• To create new ACL:

• #ip access-list <name> //creates extended ACL
• #ip access-list standard <name> //creates standard ACL

• Standard ACL:

• Here, we cannot specify the destination IP address
• We can specify only the source IP address
• #ip access-list standard test1
• (test1)#permit 10.10.10.10 0.0.0.0  //ip and wildcard
• (test2)#deny any any
• //The sequence matters. If we had used deny first, then, the deny rule itself matches, so it won’t go to the permit. Note: deny is an implicit rule. SO, no need to configure that on any ACL

• To apply the IP address, we should use on the specific interface
• If we don’t even want the packet to enter the switch and not use that switch, use the ingress interface. This is recommended as we prefer to do so near the source
• If we have another path via the switch and want the packet to take that, then, use this ACL on the not-used interface
• #int et 2/1
• #ip access-group test in //ACL is configured for the packet and doesn’t allow the IP address ‘in’
• We can see it in the counters of ACL using #show ip access-list test2

• Extended ACL:

• #ip access-list test2
• (test2)#permit ? //we can even specify higher layer protocols like TCP, UDP, OSPF, IP, ICMP, etc…
• test1)#permit tcp 10.10.10.3/32 host 10.10.10.4 eq ssh

• //Source IP for which TCP ACL is being configured
• //host tells us that the ACL is for a single destination host
• //Next we give the destination IP
• //eq is for telling which port number. We can either use the port number itself or tell the name of protocol. Eg) ssh
• Note: deny is an implicit rule. So, no need to configure that on any ACL

• The above ACL will work if the protocol is TCP and the Source and destination IP are matching and blocks ssh
• Now, try to ssh from 1st switch to 3rd switch

• We configured ssh on 2nd switch’s  egress port using:

#int et 14/1

#ip access-group test2 out

• We can see that only ssh will work, ping and all won’t work.
• We can see it in the counters of ACL using #show ip access-list test2

• Resequence: We can go into an ACL and use resequence command to resequence the ACL options
• We should optimize ACLs as TCAMs are expensive

• For example, Requirements: All VLANs should be able to communicate with each other but not to gateway.
• 
• If we have 4 VLANs, then, if we give 4 ACLs; then, it is not optimal

• 10.10.0.X                 //vlan 10 IP
• 10.10.10.X                 //vlan 20 IP
• 10.10.20.X                 //vlan 30 IP
• 10.10.30.X                 //vlan 40 IP

• So, we can use IP address and wildcard masks carefully.

• #deny 10.10.10.254 10.10.(00011110)b.0  →
•  #deny ip any 10.10.10.254 10.10.30.0
• Also, we have implicit deny, so we need to give #permit ip any any

• Thus, ACL summarization is important

• Now, to deny all odd IP address only:

• #deny <ip address> 10.10.10.0 0.0.0.254  //this wildcard applies only to all odd IP addresses

• Now to match only 4,8,16,32,64,128 IP address:

• Wildcard is X.X.X.(1111 1100)b

• See this:

• http://www.computernetworkingnotes.com/ccna-study-guide/configure-standard-access-control-list-step-by-step-guide.html
• http://www.computernetworkingnotes.com/ccna-study-guide/configure-extended-access-control-list-step-by-step-guide.html 

L2 Layer Troubleshooting for Beginners

MAC ADDRESS, VLAN, ARP:

Important commands for troubleshooting:

• Show lldp neighbors
• Show interface status
• Int et 1/1 →  show active
• Note:

• We should never try to ping any host from a switch since it will try to ping via management interface
• Always check MAC address table on switches
• Always check ARP table on hosts only (do not check on switches)

• NOTE: Do the troubleshooting in same order as below:

1. Check if shutdown
2. Check vlans
3. Check IP configurations

• One method is to start ping from host A to host B. then, go to Host B and tcpdump on the interface. If we get both a request and reply. There is a trouble in the reply path.

• Note that we cannot see the ping on in-between devices since unicasts do not go to control plane

Case 1: Interface Shut Down:

• Go to each interface in topology and do

        #int et 1/1

        #show active

And check if it is shutdown

Case 2: Trunk and Access Mismatch:

• Go to facing interfaces (both sides of a link) in topology and do

        #int et 1/1

        #show active

• Check if both are trunk and allow the vlan used

• If one of them is access vlan X and the other is trunk allowed vlan X, then, the untagged packet from access will go to the native vlan and get dropped

Case 3: IP Configuration on hosts:

• Go to hosts and check the interface IP address

• One of the hosts will be in different subnet (Then, host A will think that host B is also in same subnet. But, host B will know that it is not in same subnet...so will not reply)

Case 4: MAC Access Lists:

• Do #show active on each interface
• Check if there is a mac access-list for another mac-address ‘B’  which blocks packets from mac-address B (using ‘in’)

Case 5: Another host ‘C’ is also receiving the ping requests that was sent for another host ‘D’. Check if true?

• Start tcpdump on both hosts C and D . (we may see that no ping packets are shown….control plane)
• But, if we checked on an in-between switch’s interface #show active , we see that mac address learning is set to NO. So, there is always a broadcast due to Unknown Unicast (#no switchport mac address learning)
• Now that we know that it is supposed to be getting broadcasts, we can confirm it by going to host C and doing

• #clear counter et 49
• #watch diff show int et 49 // Other traffic will be there also...so use the other command(OR) #watch diff show int et 49 counter bins

• Go to host A and start ping for host D using large repeat count and size

Case 6: MAC Flapping:

• Use command #show logging to see mac flaps
• #show event-monitor mac can be used to see when a mac-address entry was added and removed

ICMP Messages and Message Types: What they Mean and how to troubleshoot

ICMP Message Types

The type field identifies the type of the message sent by the host or gateway. Many of the type fields contain more specific information about the error condition. Table 3.2 lists the ICMP message types.

Table 3.2 ICMP Message Types

Type	Description ICMP Message Types
0	Echo Reply (Ping Reply, used with Type 8, Ping Request)
3	Destination Unreachable
4	Source Quench
5	Redirect
8	Echo Request (Ping Request, used with Type 0, Ping Reply)
9	Router Advertisement (Used with Type 9)
10	Router Solicitation (Used with Type 10)
11	Time Exceeded
12	Parameter Problem
13	Timestamp Request (Used with Type 14)
14	Timestamp Reply (Used with Type 13)
15	Information Request (obsolete) (Used with Type 16)
16	Information Reply (obsolete) (Used with Type 15)
17	Address Mask Request (Used with Type 17)
18	Address Mask Reply (Used with Type 18)

Because each of the ICMP message headers vary depending on which one is sent, we will discuss each type separately, identifying the corresponding code fields, if applicable.

Ping: Echo Request and Reply—Types 8 and 0

We discuss the ICMP Echo Request Type 8 and Echo Reply Type 0 because ICMP uses these messages in tandem. Remote hosts use these two message types to test connectivity. As previously mentioned, the user executes the Ping utility, initiating the generation of ICMP echo requests with the expectation that the destination host sends a corresponding echo reply. Upon successful receipt of the replies to the echo requests, the messages do the following:

• Indicate a successful test.
• Assume that a valid communication path between the hosts exists.
• Assume the end host works through the Network layer.

Destination Unreachable—Type 3

ICMP Type 3 message Destination Unreachable alerts a source host of delivery problems encountered while trying to reach the destination. Note that a destination host sends only code types 2 and 3; a router can send all codes. Destination Unreachable uses several code values to further describe the function of the ICMP message being sent. Each code type describes a different delivery problem encountered, as shown here:

0 = Network Unreachable

This message indicates that the router cannot find the destination network (does not exist or has failed) or has no route to this network. In other words, the router cannot deliver or forward an IP datagram to the destination network. This could be the result of a network that is beyond the maximum distance limitation for the routing protocol in use and is therefore considered unreachable (too far). When a client attempts to connect to a host on a network that is unreachable, a gateway generates this message to alert the source host of the problem. You can think of this message as the gateway saying to the sending host, "The street you are trying to locate is not found or is too far to reach."

1 = Host Unreachable

The host unreachable message alerts the sending host that the destination host requested cannot be found. This could happen because this host has been turned off or does not exist. You can think of this message as the gateway saying to the sending host, "I found the street you were looking for, but the house you are trying to find is not there."

2 = Protocol Unreachable

Protocol unreachable indicates that the Transport layer protocol (UDP or TCP) is not available. The destination host or an intervening gateway might send this message. You can think of this message as saying, "The transport layer protocol you are attempting to communicate with is not active on this host."

3 = Port Unreachable

A port unreachable message indicates that the process or application the source host is attempting to establish a connection with is not active on the destination host. Typically this type of message is sent when an application has not been started or has failed on this host. The destination host or an intervening gateway might send this message. You can think of this message as saying, "The process or application you are attempting to communicate with is not active on this host," or, "I found the street, I found the house, the lights were on, but no one was home."

4 = Fragmentation is needed, but don't-fragment bit set

This message occurs when a router receives a datagram that requires fragmentation, but the router has the DF (don't-fragment) flag turned on. (The sending host generally has the responsibility of fragmentation. The receiver has the responsibility of reassembly.)

However, when a router cannot forward a datagram because it is too big, if allowed the router might fragment the datagram further before transmitting it to an attached segment. If the router has the DF bit set, this will not happen and the router will trash the datagram. It then generates a message to alert the sender of this action by sending a Type 3, Code 4 message. The fragmentation bit also can determine the maximum packet size or MTU that hosts can transmit end to end along the communication path.

Hosts can use the ICMP messages sent by routers to resize datagrams, dynamically adjusting to the needs of the network. This allows the host to determine the smallest MTU path to a destination.

5 = Source Route Failed

The message occurs if a router encounters a next hop in the source route that does not reside on a directly connected network.

6 = Destination Network Unknown

This message occurs when a router receives an IP datagram that it cannot deliver or forward to a particular network because it is unknown.

7 = Destination Host Unknown

This message occurs when a router receives an IP datagram that it cannot deliver or forward to a particular host because it is unknown.

8 = Source Host Isolated (obsolete)

9 = Destination Network Administratively Prohibited

This message occurs when a router receives an IP datagram that it cannot deliver or forward to a particular network because it is not allowed. Access to this network has been prohibited.

10 = Destination Host Administratively Prohibited

This message occurs when a router receives an IP datagram that it cannot deliver or forward to a particular host because it is not allowed. Access to this host has been prohibited.

11 = Network Unreachable for ToS

This message occurs when a router receives an IP datagram that it cannot deliver or forward to a particular network because the ToS requested is not available.

12 = Host Unreachable for ToS

This message occurs when a router receives an IP datagram that it cannot deliver or forward to a particular host because the ToS requested is not available.

13 = Communication Administratively Prohibited by Filtering

This message occurs when a router receives an IP datagram that it cannot deliver or forward to a particular host because it is not allowed. An administratively configured filter has prohibited access to this process or application.

14 = Host Precedence Violation

This message occurs when a router receives an IP datagram that it cannot deliver or forward to a particular host because the precedence level requested does not match, and is not accepted or is invalid. This could be a source host attempting to access a high security host without the necessary security clearance values.

15 = Precedence Cutoff in Effect

This message rarely occurs. However, you will receive this message when a packet is dropped by the cutoff function.

Precedence Handling For All Routers

Routers must accept and route incoming traffic of all precedence levels normally, unless you have configured it to do otherwise. If you want to learn more about precedence and Destination Unreachable messages 14 and 15, please refer to RFC 1812, 5.3.3.3, "Precedence Handling for All Routers."

Source Quench—Type 4

A receiving host generates this message when it cannot process datagrams at the speed requested due to a lack of memory or internal resources. This message serves as a simple flow control mechanism that a receiving host can utilize to alert a sender to slow down its transmission of data. When the source host receives this message, it must pass this information on to the upper-layer process, such as TCP, which then must control the flow of the application's datastream. A router generates this message when, in the process of forwarding datagrams, it has run low on buffers and cannot queue the datagram for delivery.

Redirect—Type 5

A router sends a redirect error to the sender of an IP datagram when the sender should have sent the datagram to a different router or directly to an end host (if the end host is local). The message assists the sending host to direct a misdirected datagram to a gateway or host. This alert does not guarantee proper delivery; the sending host has to correct the problem if possible.

Only gateways generate redirect messages to inform source hosts of misguided datagrams. Note that a gateway receiving a misdirected frame does not trash the offending datagram if it can forward it. The gateway forwards the frame, sends an alert message to the source, and hopes the source host will properly direct future frames to the designated host or gateway indicated in the message. ICMP redirect messages alert source hosts when a datagram has been misdirected and should be resent. Four redirect error codes can occur:

1. 0 = Redirect for Network
2. 1 = Redirect for Host
3. 2 = Redirect for Type-of-Service and Network
4. 3 = Redirect for Type-of-Service and Host

Router Advertisement and Solicitation—Types 9 and 10

Rather than initializing a routing table with static routes specified in configuration files, you can use the router ICMP advertisement and solicitation messages. After bootstrapping, a host can transmit a broadcast or multicast a solicitation message to which a router or routers responds with a router advertisement. This allows communicating hosts to learn of available routes dynamically and update their routing tables. We will discuss routing in more detail in Chapters 5 and 6.

Time Exceeded—Type 11

The time exceeded message occurs when a router receives a datagram with a TTL (Time To Live) of 0 or 1. IP uses the TTL field to prevent infinite routing loops. A router cannot forward a datagram that has a TTL of 0 or 1. Instead, it trashes the datagram and sends a time exceeded message. Two different time exceeded error codes can occur:

1. 0 = Time-To-Live Equals 0 During Transit
2. 1 = Time-To-Live Equals 0 During Reassembly

Note that a router cannot forward a datagram with a TTL of 0 or 1 both during transit or reassembly.

As previously mentioned in the IP section of this chapter, the TTL timer is measured in seconds and originally was used before the existence of routers to guarantee that a datagram did not live on the Internet forever. Each gateway processing a datagram reduces this value by at least one if it takes longer to process and forward the datagram. When this value expires, the gateway trashes the datagram and sends a message back to the sender notifying the host of the situation.

The traceroute utility also uses the TTL value to discover the path or route to a destination host or network. Upon execution of the traceroute command, the initial ICMP message is sent out with a TTL value of 1 set in the IP header. You can use the traceroute program to determine, or rather trace, the path to a destination. Traceroute accomplishes this by sending a sequence of datagrams with the TTL set to 1, 2, and so on. It then uses the ICMP Time Exceeded messages like a trail of breadcrumbs to trace the routers along the path. We will provide you with examples later in this section.

As you might recall from earlier in this chapter, when a router receives a datagram with a TTL of zero, it trashes the datagram and returns an ICMP time exceeded message to the source. This message allows the host to learn of the first router in the path to the destination. 

As shown in the figure, ICMP message type 11 alerts a source host of a TTL expiration. Code 0 identifies the reason for the expiration as time to live being exceeded while the datagram was in transit. This message also includes a copy of the original datagram header that caused the error to assist the source host in correcting the problem. Within the offending header contained within the ICMP message, you can see that the "TTL value = 0 seconds/hops," which is why the original datagram was trashed.

Now the source host sends a new ICMP trace with a TTL value of 2, which allows this datagram to be forwarded by the first router (which decrements the value by one) and reaches the next router in the path with a TTL of one. This router must trash the frame and send back an ICMP time exceeded. This process continues until the path to the destination network or host is fully discovered or deemed unreachable. As you can see, traceroute is another useful troubleshooting tool, typically used in conjunction with other utilities such as the Ping utility to test connectivity between two hosts.

TIP

Both the Ping and traceroute utilities can help you when troubleshooting.

Parameter Problem—Type 12

The parameter problem message indicates that a host or gateway received and could not interpret an invalid or misunderstood parameter. A host or gateway also can send this message when no other ICMP message covering the problem can be used to alert the sending host. In this respect, it is a catchall message. In most cases this message indicates some type of implementation error occurred, perhaps because of vendor incompatibility issues. A host or gateway will not send this message unless it trashes the datagram containing the parameter problem.

Two parameter problem error messages can occur:

1. 0 = IP Header Bad (catchall error0)
2. A host or gateway sends this error to indicate a general implementation error of an unspecific nature.
3. 1 = Required Option Missing
4. The host or gateway expected a specific option, but the sender did not send it.

Timestamp Request and Reply—Types 13 and 14

Timestamp request and reply messages work in tandem. You have the option of using timestamps. When used, a timestamp request permits a system to query another for the current time. It expects a recommended value returned to be the number of milliseconds since midnight, Coordinated Universal Time. This message provides millisecond resolution, considered a beneficial feature when compared to other means of obtaining time from another host who provides resolution in seconds. The two systems compare the three timestamps and use RTT to adjust the sender's or receiver's time if necessary. Note that most systems set the transmit and receive time as the same value.

The process for time resolution goes as follows:

1. The requestor stamps the originate time and sends the query.
2. The replying system stamps the receive time when it receives the query.
3. The replying system stamps the transmit time when it sends the reply to the query.

Information Request and Reply—Types 15 and 16

Although ICMP messages list information request and reply as a potential ICMP message type, they actually do not occur; thus they are obsolete. A host can request information such as to what network it was attached.

Address Mask Request and Reply—Types 17 and 18

Address mask request and reply messages work in tandem. Although we rarely use this message today, its original design supported the function of dynamically obtaining a subnet mask. Hosts can use the ICMP address mask request to acquire subnet masks during bootstrap from a remote host. However, problems can occur when using ICMP to receive a mask if a host gives an incorrect mask from an external source. If the external source does not give a response, the source host must assume a classful mask (that the network is not subnetted).

Summary

IP is the workhorse of the Network layer within the TCP/IP suite. All protocols and applications utilize IP for logical Network layer addressing and transmission of datagrams between internet hosts. IP provides an unreliable, connectionless datagram delivery service and uses ICMP to send messages when it encounters an error.

End host and routers use ICMP as a control, messaging, and diagnostic tool. ICMP utilizes IP to deliver its messages and is considered an integral part of IP. ICMP messages notify a host of problems. Although ICMP does not offer a solution to these problems, it can provide enough information for a source host to solve some of the problems that might occur in the internetwork. The most popular ICMP message is the echo request and reply. Utilizing the Ping utility, these messages allow you to test connectivity between end hosts.

This article is taken from:

Source: http://www.informit.com/articles/article.aspx?p=26557&seqNum=5