Content

| 4.1 |  | Characteristics of Data Link Layer Problems |
| 4.1.6 |  | Layer 2 to Layer 3 address mapping errors |

When a Layer 3 packet is to be forwarded to a next hop address, the packet is encapsulated within a frame and a Layer 2 destination address is applied to the frame.

Precisely how this Layer 2 address is determined depends on the Layer 2 protocol being used. For a point-to-point protocol such as PPP or HDLC, there are only two devices on each link. These protocols have no need to specifically address the far end device as there is only one possible recipient of the frame. In the case of PPP the frame always contains the all 1’s broadcast address and is therefore intended for any device at the far end of the link. Because of the nature of point-to-point protocols, it is unlikely that a Layer 2 to Layer 3 address mapping error will occur.

In topologies such as point-to-multipoint, Frame Relay, or broadcast Ethernet, it is essential that an appropriate Layer 2 destination address be given to the frame. This will ensure its arrival at the correct destination. In order to achieve this, the network device must match a destination Layer 3 (IP) address with the correct Layer 2 address. Two mechanisms can be used to achieve this:

- Static maps
- Dynamic maps (ARP)

When using static maps, an incorrect map is a common mistake. In an Ethernet environment this can easily occur when a NIC is replaced, since the NIC determines the MAC address. In a Frame-Relay environment it is possible for DLCIs to be incorrectly assigned by the Telco. In either case, simple configuration errors can result in a mismatch of Layer 2 and Layer 3 addressing information.

In a dynamic environment, the mapping of Layer 2 and Layer 3 information can fail for the following reasons:

- Devices may not respond to ARP or Inverse-ARP requests because this has been specifically configured, as with the command no frame-relay inverse-arp.
- The Layer 2 or 3 information that is cached may have physically changed. A router caches MAC addresses for 14400 seconds, or 4 hours, by default.
- Invalid ARP replies are received which could be due to misconfiguration, or as part of a Denial of Service (DoS) or Man-in-the-middle security attack.

With the exception of the “man-in-the-middle” attack, all of these problems will result in similar failure characteristics:

- No Layer 3 communications between directly connected devices.
- Layer 2 communications will appear ok.
- Appropriate debugs or console messages may indicate encapsulation failures when a Layer 2 address is required but can’t be obtained.
- Careful inspection of ARP caches will reveal no Layer 2 address or an incorrect Layer 2 address.

Useful commands for troubleshooting suspected Layer 2 – Layer 3 mapping problems include:

- show arp – examine ARP cache.
- show cdp neighbor detail – determine neighbors IP address.
- clear arp-cache – force relearning of MAC addresses when a NIC has been changed.
- show frame-relay map – determine DLCI to IP address mapping.