Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Of course a lot of network traffic occurs at lower layers, but does anything happen without a specific Layer 7 request?

share|improve this question

migrated from Dec 3 '09 at 2:08

This question came from our site for professional and enthusiast programmers.

@Dan: The only possibility I can think of is ARP/RARP – OMG Ponies Dec 1 '09 at 23:20
@OMG Ponies Thanks—I'll keep that in mind for next question. This answers my question for now though. – dan Dec 1 '09 at 23:31
up vote 5 down vote accepted

There is plenty of overhead traffic used solely by the network equipment. ARP requests, routing table exchanges and such. Keep in mind though that OSI is just a reference model and not an actual protocol stack. What is considered an application layer in one situation (http for web requests) can act as a transport for a different protocol in other situations (e.g. SOAP).

share|improve this answer
+1 for the reminder that OSI is just a model. I should add it is a model that nowadays is far from the present reality. – jldupont Dec 2 '09 at 1:31

Certainly. A DNS lookup uses UDP on layer 4 directly, not involving layers 5-7 at all. I suppose you could call DNS an "application layer" request, but there's no session or state, it's really too trivial to count as such in my opinion.


Okay, I think I see what you're asking. How about DHCP broadcasts when a host joins a network? Technically it's the dhcp client application doing the request, but it's not (necessarily) initiated by a user.

Also, when an IPv4 interface comes online, it will do an ARP probe to make sure the IP address it's configured with is not already in use.

Even deeper, routers and switches will exchange BGP messages when they come online and on a regular basis, and I believe this occurs even if no endpoints are even connected, e.g., two routers connected together and to nothing else.

share|improve this answer
But a DNS lookup is initiated by a program - a web browser for instance. – OMG Ponies Dec 1 '09 at 23:13
A DNS lookup is certainly more ephemeral than most traffic, but it's still (usually, if not always) initiated by an application request – dan Dec 1 '09 at 23:17
Thanks for the clarification—this helps. – dan Dec 1 '09 at 23:33

Even within a single TCP session there can be lower-layer traffic that's not directly triggered by higher-layer events. The best example of this is if TCP Keepalives are enabled, which will cause TCP traffic (transport layer) triggered by a simple timeout even if there is no application-layer activity.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.