17 ms·

Agreed. To take it further, the OS APIs suck for protocol selection too. And router technologies. And basically everything. E.g. in theory your router should w

by junon 6y ago

Agreed. To take it further, the OS APIs suck for protocol selection too. And router technologies. And basically everything. E.g. in theory your router should work with level 3 and below. This includes the firewall. However, try to implement a new Level 4 protocol and all of a sudden your packets won't route. This was the whole point of this separation - that while UDP and TCP are useful in general cases, there are much better and novel ways to frame packets for e.g. cust infrastructure with different properties and different requirements. But it simply doesn't work. This stuff has driven me nuts for decades. OSI has rarely been helpful aside from just general communication of ideas. It shouldn't be used as any authoritative reference, ESPECIALLY not in classrooms.

walrus01 6y ago
> E.g. in theory your router should work with level 3 and below. If you look at the configuration on a typical small but powerful router (I'll use a Juniper MX204 for an example), of course it's doing things at both layers 2 and 3. It's a useful model to define what is going on with various ethernet switch fabrics, before you try to understand how it's set up at layer 3. At layer 2 you could have a 100GbE interface that carries a vlan trunk going to a 1RU 48-port switch physically adjacent to the mx204, to create local subinterfaces on the router to 10Gbps PNI peers, to downstream colocation/datacenter customers, etc. That's all traditional "layer 2" ethernet stuff. Then your logical subinterfaces themselves are configured as BGP peers, which is of course layer 3. Understanding the model of your theoretical MX204 you've got: layer 1: AC or DC power, cabling, fans, physical mounting, serial console cables also layer 1, but has an impact on how you can configure stuff at layer 2: Does this port have a short reach 100GbE CWDM4 interace in it? Or a longer reach coherent? Maybe this 10GbE port has a 1490/1550 bidi single strand in it? layer 2: Ethernet configuration in all its myriad ways. And also things like P and PE MPLS configuration to carry a layer 2 circuit between places over your layer 3 network. Configuration for ISIS would also go in layer 2. layer 3: bgp, ospf, all the typical "router" stuff.
- comex 6y ago
  I believe the parent isn’t complaining that routers do things at layers 1-3, but that they also do things at layer 4 (namely, block anything that isn’t TCP or UDP).
  - TeMPOraL 6y ago
    Isn't this just a naming issue, though? I remember initially being confused by "switches" doing layer 3 stuff and "routers" doing layer 4 stuff, but over the years I've just learned to revise the definitions in my head; now I consider "router" to be a box that works on most layers (up to all of them with a sufficiently smart router), and "switch" to be just a cheaper router with more Ethernet ports. Layers seem OK for dividing protocols, but networks tend to be managed across all layers, so it's understandable all that functionality gets put in a single device - possibly internally structured one. I'm not a network engineer, but what I understand from the admin panel of my Mikrotik router is that the mental model here is a bunch of virtual devices, each working on one of the layers, packaged into one physical box.
    - walrus01 6y ago
      In terms of equipment capabilities we most certainly have switches that have sets of layer 3 capabilities, even a ten year old cisco 3750x can do basic OSPF, BGP, EIGRP etc. Often referred to as an enhanced or layer 3 switch. https://www.cisco.com/c/en/us/products/collateral/switches/catalyst-3560-x-series-switches/data_sheet_c78-584733.html https://www.cisco.com/c/en/us/products/collateral/switches/c... But you for sure wouldn't call it a router because it has nowhere near the routing table RAM, routing ability, or full set of routing configuration parameters as you would want to use on a dedicated purpose router. For your mikrotik, if you open it up or if you look at someone's teardown of one, what you'll see is a set of gigabit ethernet switch chips (perhaps 1 ASIC per every 4 ports) under heatsinks, that have purely layer 2 feature sets only. And then one CPU that runs the mikrotik routerOS which does layer 3 things. The mikrotik will have different levels of performance in packets per second capability for traffic flows that stay at purely layer 2, and another level of capability in Mbps and pps at layer 3. The OS on the mikrotik knows how to tell the switch chips how to do things at layer 2 (define this vlan, define this trunk, group certain ports into the same fabric, do 802.1x stuff, etc). for instance here's a block diagram of a mikrotik rb4011: https://i.mt.lv/cdn/product_files/RB4011iGSplusRM_180903.png https://i.mt.lv/cdn/product_files/RB4011iGSplusRM_180903.png
kortilla 6y ago
> E.g. in theory your router should work with level 3 and below. This includes the firewall. However, try to implement a new Level 4 protocol and all of a sudden your packets won't route. If you’re talking about something that is just routing and not doing a higher layer operation like NAT then routers don’t care about layer 4. The huge routers running the Internet backbones absolutely don’t care about layer 4 protocols and support arbitrary L4 protocols. What you’re thinking of is normally sold as a “home router”, which is actually a NAT device that is only a router in the most basic sense (has directly connected interface routes and a default route). NAT is the thing that breaks the transparency because it has to modify and track layer 4 protocol fields in order to disambiguate all of the traffic coming into the single IP address you get at home.
Hikikomori 6y ago
Not sure what you mean, this separation does exist in routers we have today. A router that forwards packets based on only the destination IP address wouldn't care about your fancy new L4 protocol at all. Most ISP routers would be capable of this. It would not be possible with most SOHO routers because they use NAT which mostly only compatible with TCP and UDP (though a more advanced SOHO router is capable of doing 1:1 for other L4 protocols).
perryizgr8 6y ago
> But it simply doesn't work. My work involves writing software for big routers and switches used by ISPs, data centers, campuses, etc. and I can guarantee you that a router will 100% switch/route your exotic packets with an unknown L4 protocol number. It literally does not care about anything past the IP header. There are a few things I can think of that may have led to your experience, one of them is NAT. Well, NAT just sucks. It is the reason why I want IPv4 to die. Just getting rid of NAT will be worth the pain of switching to IPv6. PS - IPv6 NAT is just downright stupid.
jcrawfordor 6y ago
I make a lot of use of "Layer 3 switches" and I try to always say that with scarequotes, along with "smart firewall" and "router". For a lot of reasons, some good and more bad, network vendors have mostly abandoned the tidy separation of concerns often taught in classes. I still say "SCTP is the future" in the voice of a professor who repeated this endlessly, and the failed adoption of SCTP is a big symptom of the practical difficulties actually posed by the layer model. Far more common today is to handle unusual "L4" protocols by tunneling them, which leads to another increasingly common situation that teaching via the OSI model does not prepare students for: "L2" protocols tunneled back through an "L3" protocol. Or in telco networks usually, through a different "L2" protocol (MPLS, ATM, pick your poison). These are all things that the layered network model empowers us to do, but the "OSI-first" teaching approach, at least as I have seen it, mentions scarcely or not at all.

by junon 6y ago

walrus01 6y ago

> E.g. in theory your router should work with level 3 and below. If you look at the configuration on a typical small but powerful router (I'll use a Juniper MX204 for an example), of course it's doing things at both layers 2 and 3. It's a useful model to define what is going on with various ethernet switch fabrics, before you try to understand how it's set up at layer 3. At layer 2 you could have a 100GbE interface that carries a vlan trunk going to a 1RU 48-port switch physically adjacent to the mx204, to create local subinterfaces on the router to 10Gbps PNI peers, to downstream colocation/datacenter customers, etc. That's all traditional "layer 2" ethernet stuff. Then your logical subinterfaces themselves are configured as BGP peers, which is of course layer 3. Understanding the model of your theoretical MX204 you've got: layer 1: AC or DC power, cabling, fans, physical mounting, serial console cables also layer 1, but has an impact on how you can configure stuff at layer 2: Does this port have a short reach 100GbE CWDM4 interace in it? Or a longer reach coherent? Maybe this 10GbE port has a 1490/1550 bidi single strand in it? layer 2: Ethernet configuration in all its myriad ways. And also things like P and PE MPLS configuration to carry a layer 2 circuit between places over your layer 3 network. Configuration for ISIS would also go in layer 2. layer 3: bgp, ospf, all the typical "router" stuff.

comex 6y ago
I believe the parent isn’t complaining that routers do things at layers 1-3, but that they also do things at layer 4 (namely, block anything that isn’t TCP or UDP).
- TeMPOraL 6y ago
  Isn't this just a naming issue, though? I remember initially being confused by "switches" doing layer 3 stuff and "routers" doing layer 4 stuff, but over the years I've just learned to revise the definitions in my head; now I consider "router" to be a box that works on most layers (up to all of them with a sufficiently smart router), and "switch" to be just a cheaper router with more Ethernet ports. Layers seem OK for dividing protocols, but networks tend to be managed across all layers, so it's understandable all that functionality gets put in a single device - possibly internally structured one. I'm not a network engineer, but what I understand from the admin panel of my Mikrotik router is that the mental model here is a bunch of virtual devices, each working on one of the layers, packaged into one physical box.
  - walrus01 6y ago
    In terms of equipment capabilities we most certainly have switches that have sets of layer 3 capabilities, even a ten year old cisco 3750x can do basic OSPF, BGP, EIGRP etc. Often referred to as an enhanced or layer 3 switch. https://www.cisco.com/c/en/us/products/collateral/switches/catalyst-3560-x-series-switches/data_sheet_c78-584733.html https://www.cisco.com/c/en/us/products/collateral/switches/c... But you for sure wouldn't call it a router because it has nowhere near the routing table RAM, routing ability, or full set of routing configuration parameters as you would want to use on a dedicated purpose router. For your mikrotik, if you open it up or if you look at someone's teardown of one, what you'll see is a set of gigabit ethernet switch chips (perhaps 1 ASIC per every 4 ports) under heatsinks, that have purely layer 2 feature sets only. And then one CPU that runs the mikrotik routerOS which does layer 3 things. The mikrotik will have different levels of performance in packets per second capability for traffic flows that stay at purely layer 2, and another level of capability in Mbps and pps at layer 3. The OS on the mikrotik knows how to tell the switch chips how to do things at layer 2 (define this vlan, define this trunk, group certain ports into the same fabric, do 802.1x stuff, etc). for instance here's a block diagram of a mikrotik rb4011: https://i.mt.lv/cdn/product_files/RB4011iGSplusRM_180903.png https://i.mt.lv/cdn/product_files/RB4011iGSplusRM_180903.png

kortilla 6y ago

> E.g. in theory your router should work with level 3 and below. This includes the firewall. However, try to implement a new Level 4 protocol and all of a sudden your packets won't route. If you’re talking about something that is just routing and not doing a higher layer operation like NAT then routers don’t care about layer 4. The huge routers running the Internet backbones absolutely don’t care about layer 4 protocols and support arbitrary L4 protocols. What you’re thinking of is normally sold as a “home router”, which is actually a NAT device that is only a router in the most basic sense (has directly connected interface routes and a default route). NAT is the thing that breaks the transparency because it has to modify and track layer 4 protocol fields in order to disambiguate all of the traffic coming into the single IP address you get at home.

Hikikomori 6y ago

Not sure what you mean, this separation does exist in routers we have today. A router that forwards packets based on only the destination IP address wouldn't care about your fancy new L4 protocol at all. Most ISP routers would be capable of this. It would not be possible with most SOHO routers because they use NAT which mostly only compatible with TCP and UDP (though a more advanced SOHO router is capable of doing 1:1 for other L4 protocols).

perryizgr8 6y ago

> But it simply doesn't work. My work involves writing software for big routers and switches used by ISPs, data centers, campuses, etc. and I can guarantee you that a router will 100% switch/route your exotic packets with an unknown L4 protocol number. It literally does not care about anything past the IP header. There are a few things I can think of that may have led to your experience, one of them is NAT. Well, NAT just sucks. It is the reason why I want IPv4 to die. Just getting rid of NAT will be worth the pain of switching to IPv6. PS - IPv6 NAT is just downright stupid.

jcrawfordor 6y ago

I make a lot of use of "Layer 3 switches" and I try to always say that with scarequotes, along with "smart firewall" and "router". For a lot of reasons, some good and more bad, network vendors have mostly abandoned the tidy separation of concerns often taught in classes. I still say "SCTP is the future" in the voice of a professor who repeated this endlessly, and the failed adoption of SCTP is a big symptom of the practical difficulties actually posed by the layer model. Far more common today is to handle unusual "L4" protocols by tunneling them, which leads to another increasingly common situation that teaching via the OSI model does not prepare students for: "L2" protocols tunneled back through an "L3" protocol. Or in telco networks usually, through a different "L2" protocol (MPLS, ATM, pick your poison). These are all things that the layered network model empowers us to do, but the "OSI-first" teaching approach, at least as I have seen it, mentions scarcely or not at all.