I have researched about Ethernet keepalive for quite a long time and I think it is time to check whether what I know is correct because I found no certainty in this topic.

Ethernet keepalive is:

  1. to test L2 functionality. The frame has same source MAC and destination MAC (ethertype 0×9000). The other end of Ethernet interface will TX back this type of frame. If the interface does not receive its own frame, then L1 & L2 have problem.

  2. to detect network loop. On same switch, if the Ethernet keepalive frame of fa0/0 is received by other port, then it means there is network loop.

My question is how come ethernet (FE, GE) ports status of router and switch for L2 (protocol) are up when the port is connected to hub? Hub does not analyze frame thus it will not know the frame type and thus forward back the frame on the port it receives the frame.

Useful resources: 1 2 3

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.
    – Ron Maupin
    Aug 6, 2017 at 23:43

2 Answers 2


Detecting link on a port is not done using ethernet frames, but with electrical pulses known as normal link pulses. If no frames are being sent, a device puts these on the wire every 16 ms (+/- 8 ms). They are also used for autonegotiation.

A link is considered down if no frames and no pulses are received. Receiving the pulses will make a Cisco tell you the port is up, but as we all know, it is perfectly possible to have "FastEthernet0/0 is up, line protocol is down".

The normal link pulses are not frames, and will not be forwarded by hubs or switches.

Keepalive frames are forwarded or switched, and can be used to detect a loop.

  • As far as I know, link pulse is for L1 (link), not L2 (protocol). From what I understand, an Ethernet interface has to receive back its own Ethernet keepalive frame. Otherwise, L2 (protocol)=down. My concern is, when ethernet interface on router and switch is connected to hub and media converter, L2 (protocol)=up. Please correct me.
    – Ron Vince
    Sep 21, 2014 at 11:32

I misunderstand what you were confused about; rereading the question, 1 is completely backwards. If a host sees its own loopback frames you have a loop or duplicate address.

The only time you might want to see it is with an external loopback plug to test a possibly faulty NIC.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.