2

This is sample of a traceroute to google.com:

TraceRoute from Network-Tools.com to 216.58.194.46 [google.com]
Hop (ms)    (ms)    (ms)             IP Address Host name
1     0       0       0          206.123.64.233   -  
2     Timed out       Timed out       Timed out               -  
3     1       1       1          4.68.70.166     google-level3-3x10g.dallas.level3.net  
4     1       1       1          108.170.240.129      -  
5     1       1       1          209.85.242.53    -  
6     1       1       1          216.58.194.46   dfw25s12-in-f14.1e100.net  

Trace complete

It should be many layer 2 network device from our source to destination, that is not visible but They have an important impact on the result; these layer 2 of the network devices have many roles, including security issue like Span, Tap, deep packet inspection or any other security usage or just a layer 2 switche. You can see some hop counts in the traceroute results, but there are certainly many L2 devices in the middle and I am looking for theory or practical way to find an answer to this question.

Improve this question
1
  • 1
    Layer-2 is local. Layer-2 information is completely lost at each layer-3 connection, and many layer-2 devices, e.g. ethernet switches are transparent devices.
    – Ron Maupin ♦
    Aug 29, 2016 at 11:56

2 Answers 2

Reset to default
4

Just adding to Stuggi's fine answer: layer 2 has no TTL concept, so there's no way to build a traceroute-like tool for hop-by-hop analysis.

How can we identify layer two device in a network or what are those device effects on a frame?

You can't identify an L2 device, at least not with a generic tool like traceroute and definitely not without device access.

There are vendor-specific tools that allow you to check L2 connectivity and display potential paths, based on the device configurations (usually read by SNMP).

Some L2 devices identify themselves using LLDP or CDP but I'm not sure if that helps you.

Any L2 device adds some delay to the forwarded frame, depending on the device and possibly on its configuration. Common delays are between 1 and 10 µs.

Also, depending on the device configuration, a device like a switch can add, remove, or change frame tags like 802.1Q (used for VLAN ID and priority (PCP)) but won't touch the rest of the frame. Likewise, even an L2 device may change the IP packet's DSCP but won't touch anything else.

Improve this answer
10
  • Then the short answer is "you can't", at least not without a vendor-specific tool that simulates the path based on the device configs.
    – Zac67 ♦
    Jun 11, 2019 at 11:03
  • Maybe not yet but it should be possible, by analyzing of the effect of L2 net Devices on a packet we can find a clue to begin, like "latency" .every such that device has effects on the packet.
    – R1w
    Jun 11, 2019 at 11:09
  • 1
    @R1w An L2 device like a switch doesn't make any change to a forwarded frame*, especially not to the packet inside the frame. Of course you could track a frame's progress by setting up a bunch of mirroring ports. (* Switches might change the 802.1Q and other tags when they're used but they don't touch the core frame.)
    – Zac67 ♦
    Jun 11, 2019 at 11:16
  • To add to your comment, I should mention that i tried to find my answer in a lab and till now I just find out that L2 dev has latency effect, it is because of the processing procedure.
    – R1w
    Jun 11, 2019 at 11:23
  • Any forwarding device (or even a cable) adds some delay. I'm not sure how you want to use that though...
    – Zac67 ♦
    Jun 11, 2019 at 12:15
6

Traceroute is a Layer3 technology, aka. by it's very design it'll never show anything else than the routers in path to the specific host. Traceroute works by sending packets with decreasing TTL, thus making every router in the path respond with a message say that the TTL value has been exceeded.

Switches live in L2, so they have no concept about what's in the frames containing the traceroute packets, they just forward them appropriately so that they reach the correct next hop router.

IPS:es are usually also designed so that they sit out of band, and only extract packets that they don't like. As such, they will never respond with anything to a host sending the packets, they just drop the packets if they match a specific filter rule.

Improve this answer
1
  • Well, you started the question of with the output of traceroute, so I ran with it. :)
    – Stuggi
    Jun 13, 2019 at 21:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.