Where do ICMP, OSPF, BGP, DHCP, STP and TLS fit in the models?
Show the answer
Say this first
Place each protocol by what carries it, then mention what it serves. ICMP rides in IP (protocol 1) and is part of layer 3. OSPF rides in IP as protocol 89, a layer 3 control protocol. BGP runs over TCP port 179, so it is an application by encapsulation that controls layer 3 routing. DHCP uses UDP 67 and 68. STP BPDUs are layer 2 frames. TLS sits above TCP and below HTTP.
Go deeper
Reference table
| Protocol | Carried in | Serves |
|---|---|---|
| ARP | Ethernet, EtherType 0x0806 | IP to MAC resolution |
| STP BPDU | 802.3 frame with LLC to 01:80:C2:00:00:00 | Layer 2 loop prevention |
| LLDP | Ethernet, EtherType 0x88CC to 01:80:C2:00:00:0E | Neighbor discovery |
| MPLS | Label stack between layer 2 and IP, EtherType 0x8847 | Label switching ("layer 2.5") |
| ICMP | IP protocol 1 | Error reporting and diagnostics |
| EIGRP | IP protocol 88 | Routing |
| OSPF | IP protocol 89 | Routing |
| GRE | IP protocol 47 | Tunneling |
| ESP and AH | IP protocols 50 and 51 | IPsec |
| VRRP | IP protocol 112 | Gateway redundancy |
| BGP | TCP 179 | Routing between and within autonomous systems |
| DHCP | UDP 67 server, 68 client | Host configuration |
| DNS | UDP 53, TCP 53 for large answers and zone transfers | Name resolution |
| TLS | Over TCP (QUIC folds TLS 1.3 into its own handshake over UDP) | Encryption and authentication |
The point behind the question
The interviewer is checking whether you understand encapsulation. BGP is the classic trap: it is a routing protocol, yet it rides on TCP and needs IP reachability to the neighbor before it can even start.
They will ask next
Why does it matter that BGP runs over TCP and OSPF does not?
BGP gets reliability, ordering and flow control from TCP, so it can send large tables incrementally and peer with routers several hops away. OSPF talks directly over IP, mostly to link-local multicast
224.0.0.5and224.0.0.6, and builds its own reliability with acknowledgments.
Traps
- Saying BGP is "layer 3" without mentioning TCP 179. The encapsulation is the point.