Process context for low-layer network protocols?

Which linux process deals with data link layer protocols?

Atit wrote:
> Which linux process deals with data link layer protocols?
Depends on the protocol you are speaking of. Most of them require no
process to impelment. For instance 802.3 ethernet is a data link layer
protocol, and is simply the ethernet encapsulation format, which
requires no process to implement. If you are referring to data link
layer protocols like 802.1d spanning tree or the like, I think those are
implemented by the bridging driver, and use timers to implement the
periodic frame transmissions they require, but have no associated process.

HTH
Neil
--
Neil Horman
Red Hat, Inc., http://people.redhat.com/nhorman
gpg keyid: 1024D / 0x92A74FA1, http://www.keyserver.net

How about ICMP then?

Neil Horman <nhorman@rNeOdShPaMt.com> wrote in message news:<braas1$lps$1@stan.redhat.com>...
> Atit wrote:
> > Which linux process deals with data link layer protocols?
> Depends on the protocol you are speaking of. Most of them require no
> process to impelment. For instance 802.3 ethernet is a data link layer
> protocol, and is simply the ethernet encapsulation format, which
> requires no process to implement. If you are referring to data link
> layer protocols like 802.1d spanning tree or the like, I think those are
> implemented by the bridging driver, and use timers to implement the
> periodic frame transmissions they require, but have no associated process.
>
> HTH
> Neil

Atit wrote:
> How about ICMP then?
>
> Neil Horman <nhorman@rNeOdShPaMt.com> wrote in message news:<braas1$lps$1@stan.redhat.com>...
>
>>Atit wrote:
>>
>>>Which linux process deals with data link layer protocols?
>>
>>Depends on the protocol you are speaking of. Most of them require no
>>process to impelment. For instance 802.3 ethernet is a data link layer
>>protocol, and is simply the ethernet encapsulation format, which
>>requires no process to implement. If you are referring to data link
>>layer protocols like 802.1d spanning tree or the like, I think those are
>>implemented by the bridging driver, and use timers to implement the
>>periodic frame transmissions they require, but have no associated process.
>>
>>HTH
>>Neil

ICMP is part of the TCP/IP suite, and is considered a network layer
protocol. ICMP messages are implemented primarily in the network stack,
and require no process to implement, as most of the messages are
generated in response to receiving other packets. You can trace through
the code starting at icmp_init in the kernel, if you would like to see
where it hooks in. The notable exception to this case is the ICMP echo
request message (AKA ping) which is implemented via the ping program.

HTH
Neil

--
Neil Horman
Red Hat, Inc., http://people.redhat.com/nhorman
gpg keyid: 1024D / 0x92A74FA1, http://www.keyserver.net

I am observing that if I keep pinging a target linux system overnight
there are few times when my system stops responding to pings for 2 to
3 secs randomly and then starts responding again. I ping the target
system every 2 seconds. What can be possible reasons?...I doubt it's
network traffic.

Neil Horman <nhorman@rNeOdShPaMt.com> wrote in message news:<brce6j$p1k$1@stan.redhat.com>...
> Atit wrote:
> > How about ICMP then?
> >
> > Neil Horman <nhorman@rNeOdShPaMt.com> wrote in message news:<braas1$lps$1@stan.redhat.com>...
> >
> >>Atit wrote:
> >>
> >>>Which linux process deals with data link layer protocols?
> >>
> >>Depends on the protocol you are speaking of. Most of them require no
> >>process to impelment. For instance 802.3 ethernet is a data link layer
> >>protocol, and is simply the ethernet encapsulation format, which
> >>requires no process to implement. If you are referring to data link
> >>layer protocols like 802.1d spanning tree or the like, I think those are
> >>implemented by the bridging driver, and use timers to implement the
> >>periodic frame transmissions they require, but have no associated process.
> >>
> >>HTH
> >>Neil
>
> ICMP is part of the TCP/IP suite, and is considered a network layer
> protocol. ICMP messages are implemented primarily in the network stack,
> and require no process to implement, as most of the messages are
> generated in response to receiving other packets. You can trace through
> the code starting at icmp_init in the kernel, if you would like to see
> where it hooks in. The notable exception to this case is the ICMP echo
> request message (AKA ping) which is implemented via the ping program.
>
> HTH
> Neil

Atit wrote:
> I am observing that if I keep pinging a target linux system overnight
> there are few times when my system stops responding to pings for 2 to
> 3 secs randomly and then starts responding again. I ping the target
> system every 2 seconds. What can be possible reasons?...I doubt it's
> network traffic.
>
> Neil Horman <nhorman@rNeOdShPaMt.com> wrote in message news:<brce6j$p1k$1@stan.redhat.com>...
>
>>Atit wrote:
>>
>>>How about ICMP then?
>>>
>>>Neil Horman <nhorman@rNeOdShPaMt.com> wrote in message news:<braas1$lps$1@stan.redhat.com>...
>>>
>>>
>>>>Atit wrote:
>>>>
>>>>
>>>>>Which linux process deals with data link layer protocols?
>>>>
>>>>Depends on the protocol you are speaking of. Most of them require no
>>>>process to impelment. For instance 802.3 ethernet is a data link layer
>>>>protocol, and is simply the ethernet encapsulation format, which
>>>>requires no process to implement. If you are referring to data link
>>>>layer protocols like 802.1d spanning tree or the like, I think those are
>>>>implemented by the bridging driver, and use timers to implement the
>>>>periodic frame transmissions they require, but have no associated process.
>>>>
>>>>HTH
>>>>Neil
>>
>>ICMP is part of the TCP/IP suite, and is considered a network layer
>>protocol. ICMP messages are implemented primarily in the network stack,
>>and require no process to implement, as most of the messages are
>>generated in response to receiving other packets. You can trace through
>>the code starting at icmp_init in the kernel, if you would like to see
>>where it hooks in. The notable exception to this case is the ICMP echo
>>request message (AKA ping) which is implemented via the ping program.
>>
>>HTH
>>Neil
It could be due to any number of reasons:

1) Is the linux server running a special workload at night? Something
CPU or memory intensive perhaps, that might cause it to drop a packet
now and again?

2) Is the client machine doing anything that might cause it to miss a reply?

3) Is the network in a state of flux overnight during a maintenence
period? Does the network spanning tree state change, causing a periodic
loss of connectivity.

I'd take a tcpdump both on the client and the server machine, filtering
on the ICMP messages between the two boxes, so that you can tell whats
really going on (is the linux box missing a request, or is the client
simply missing a reply, or neither). From there you can start to
investiage the environment on the offending machine during the period of
failure.

Neil

--
Neil Horman
Red Hat, Inc., http://people.redhat.com/nhorman
gpg keyid: 1024D / 0x92A74FA1, http://www.keyserver.net