OSI Troubleshooting

Using a layered approach can be very effective when you’re troubleshooting your network. The
only decision from this point onwards is to determine which way you want to use the OSI stack
– top-down, bottom-up, or divide-and-conquer method, which involves focusing on sections of
the network in turn.
I recommend using the bottom-up method at the beginning so you don’t waste time looking at
applications when the cause can often be found at the lower layers, such as loose or broken
cables or incorrect IP addressing. As you gain more experience, using the divide-and-conquer
method will probably be faster, depending on the symptoms. If you start at the bottom layer
and work your way up, you would do something like this:

Layer 1

Are all the cables inserted into the ports correctly, or have they come loose? Are thecable ends bent or worn out? If cables are the problem, you will usually see an amber lightshowing on the device when it should be green. Has somebody forgotten to add the correctspeed to the interface? Has the speed of the Ethernet port been set correctly? Has the interfacebeen opened for use by the network administrator?

Layer 2

 Has the correct protocol been applied to the interface so it agrees with the other side,
such as Ethernet/PPP/HDLC, etc.?

Layer 3 

 Is the interface using the correct IP address and subnet mask?

Layer 4 

 Is the correct routing protocol being used, and is the correct network being advertised
from the router?
You will see how to apply these steps as you complete the labs in this book. Experts may argue
that some Layer 4 issues are at Layer 3, some Layer 2 issues are actually at Layer 1, and so on. I
prefer to focus on the fact that we are applying a layered troubleshooting method rather than
debating about whether the correct issue is at the correct layer.
The TCP/IP, or DoD, Model
The TCP/IP model is another framework and an alternative to the OSI model. The TCP/IP model
is a four or five-layered model created by an association known as DARPA. It is also known as
the Department of Defense (DoD) model. The four layers from the top down are as follows:

4 –Application [Telnet/FTP/DNS/RIP]

Application Data, but not encapsulated yet
Transport TCP header added to the data Segment
Network IP header added (including IP address) Packet
Data Link Data Link header added (Data Link address) Frame
Physical Turned into electrical signals Bits on the wire

Layer # OSI Data

7 Application Application
6 Presentation
5 Session
4 Transport Host to Host
3 Network Internetwork
2 Data Link Network
1 Physical Interface
3 – Transport/Host-to-Host [UDP/TCP/ICMP]
2 – Internet or Internetwork [IPSec/IP]
1 – Link/Network Interface [Frame Relay/Ethernet/ATM]
The TCP/IP model has been updated from four to five layers, so you may be asked questions
about a five-layered TCP model in the exam. The upper layers are closer to the end-user and
the lower layers describe how the technology or protocols interact with other systems. The fivelayered

TCP model is as follows:

5 – Application [Telnet/FTP/DNS/RIP/HTTP]
4 – Transport/Host-to-Host [UDP/TCP/ICMP]
3 – Network [IPSec/IP]
2 – Data Link [Ethernet/Frame Relay/PPP]
1 – Link/Network Interface/Physical [Bits on the wire]
A five-layered TCP model allows for more granularity and it more accurately represents what
actually occurs before data is put onto the wire. For example, at Layer 2 encapsulation of data
occurs and addressing takes place (i.e., Data Link addressing). Cisco seem to prefer the fivelayered
model when it comes to exam questions.
Data is encapsulated as it travels down from the Application Layer to the Physical Layer in
exactly the same way as demonstrated in the OSI model,