1. SKZ 1 Chapter 13 Wired LANs: Ethernet Copyright © The McGraw-Hill Companies, Inc. Permission required for reproduction or display. And Exploration CCNA 1 Chapter 9

2. SKZ 2 Ethernet- First LAN Designed by Robert Metcalfe and his coworkers at Xerox in 1976. The first Ethernet standard was published in 1980 by a consortium of Digital Equipment Corporation, Intel, and Xerox (DIX).

3. SKZ 3 IEEE Standards In 1985, IEEE published standards for LANs which started with the number 802. The standard for Ethernet is 802.3 Project 802 is a way of specifying functions of the physical layer and the data link layer of major LAN protocols.

4. SKZ 4 Standards and Implementation Layer 2 divided into two distinct areas of functionality or sub-layers.Layer 2 divided into two distinct areas of functionality or sub-layers. –Logical Link Control (LLC) – 802.2: To communicate with the Network Layer.To communicate with the Network Layer. –Media Access Control (MAC) – 802.3: To handle MAC addressing, framing and communication with the Physical Layer.To handle MAC addressing, framing and communication with the Physical Layer.

5. SKZ 5 Ethernet Communication Through the LAN

6. SKZ 6 Legacy Ethernet HubHub Half Duplex: Half Duplex: One way traffic. One way traffic. Necessary on a shared media. Necessary on a shared media. Only one device can transmit at a time. Only one device can transmit at a time. Collisions occur. Collisions occur.

7. SKZ 7 SwitchSwitch Legacy Ethernet Full Duplex: Full Duplex: Two way traffic. Two way traffic. Not a shared media. Not a shared media. Dedicated switch connection. Dedicated switch connection. A device can transmit and receive at the same time. A device can transmit and receive at the same time. No Collisions. No Collisions.

8. SKZ 8 Legacy Ethernet Ethernet with hubs is designed to work with collisions.Ethernet with hubs is designed to work with collisions. Collisions occur when devices transmit at the same time. Collisions occur when devices transmit at the same time. Managed by CSMA/CD. Managed by CSMA/CD. As more devices are added, more collisions occur. As more devices are added, more collisions occur. As more collisions occur, network performance degrades. As more collisions occur, network performance degrades. Half Duplex communication. Half Duplex communication. Ethernet with switches is designed to eliminate collisions.Ethernet with switches is designed to eliminate collisions. Each device attached to switch only receives frames destined for that device. Each device attached to switch only receives frames destined for that device. Full Duplex communication. Full Duplex communication.

9. SKZ 9 The Frame – Encapsulating the Packet

10. SKZ 10 Minimum and Maximum Lengths If the frame is less than the minimum or greater than the maximum, it is considered corrupt and will be dropped.

11. SKZ 11 Encapsulating the Packet Preamble and Start of Frame Delimiter (SFD)Preamble and Start of Frame Delimiter (SFD) –Used to synchronize the NIC with the media in preparation for receiving a frame. –Is not considered part of the frame length. –Will not appear in any capture of the frame. LENGTH OF FIELD IN BYTES 7166246 – 15004 Preamble Start of Frame Delimiter Destinatio n MAC Address Source MAC Address Lengt h or Type Data and PadFCS

12. SKZ 12 Encapsulating the Packet Destination MAC Address – 6 bytes:Destination MAC Address – 6 bytes: Identifies the node that is to receive the frame. Identifies the node that is to receive the frame. A receiving device compares its MAC address to the contents of this field. A receiving device compares its MAC address to the contents of this field. If the addresses match, the frame is accepted. If the addresses match, the frame is accepted. Also used by switches to determine the interface to be used to forward the frame. Also used by switches to determine the interface to be used to forward the frame. LENGTH OF FIELD IN BYTES 7166246 – 15004 Preamble Start of Frame Delimiter Destination MAC Address Source MAC Address Length or Type Data and PadFCS

13. SKZ 13 Encapsulating the Packet Source MAC Address – 6 bytes:Source MAC Address – 6 bytes: Identifies the node that originated the frame. Identifies the node that originated the frame. Also used by switches to add addresses to their internal Port / MAC address tables. Also used by switches to add addresses to their internal Port / MAC address tables. LENGTH OF FIELD IN BYTES 7166246 – 15004 Preamble Start of Frame Delimiter Destination MAC Address Source MAC Address Length or Type Data and PadFCS

14. SKZ 14 Encapsulating the Packet Length / Type – 2 bytes:Length / Type – 2 bytes: DIX used this for type, the original IEEE 802.3 standard used it for length. The later IEEE standard (Ethernet II) allows it to be used for either. DIX used this for type, the original IEEE 802.3 standard used it for length. The later IEEE standard (Ethernet II) allows it to be used for either. If the value is greater than 1518 (0x600), it contains a code identifying the encapsulated upper layer protocol. If the value is greater than 1518 (0x600), it contains a code identifying the encapsulated upper layer protocol. Any other value defines the length of the frame. Any other value defines the length of the frame. LENGTH OF FIELD IN BYTES 7166246 – 15004 Preamble Start of Frame Delimiter Destination MAC Address Source MAC Address Length or Type Data and PadFCS

15. SKZ 15 Encapsulating the Packet Data and Pad – 46 to 1500 bytes:Data and Pad – 46 to 1500 bytes: The encapsulated data from Layer 3. The encapsulated data from Layer 3. Most commonly an IPv4 packet. Most commonly an IPv4 packet. If the total frame length is less than 64 bytes, the field is padded to the right with enough null characters to meet the minimum frame length. If the total frame length is less than 64 bytes, the field is padded to the right with enough null characters to meet the minimum frame length. LENGTH OF FIELD IN BYTES 71662 46 – 1500 4 Preamble Start of Frame Delimiter Destination MAC Address Source MAC Address Length or Type Data and Pad FCS

16. SKZ 16 Encapsulating the Packet Frame Check Sequence (FCS)– 4 bytes:Frame Check Sequence (FCS)– 4 bytes: Used to detect errors in a frame that may have occurred during transmission along the media. Used to detect errors in a frame that may have occurred during transmission along the media. The result of a Cyclic Redundancy Check (CRC) is placed in the frame by the sending node. The result of a Cyclic Redundancy Check (CRC) is placed in the frame by the sending node. The receiving node performs the same CRC and compares the values….they should be equal. The receiving node performs the same CRC and compares the values….they should be equal. LENGTH OF FIELD IN BYTES 7166246 – 15004 Preamble Start of Frame Delimiter Destination MAC Address Source MAC Address Length or Type Data and PadFCS

17. SKZ 17 Frame Check Sequence The Frame Check Sequence (FCS) field (4 bytes) is used to detect errors in a frame. It uses a cyclic redundancy check (CRC).

18. SKZ Cyclic Redundancy Check

19. SKZ XORing of two single bits or two words

20. SKZ 20 MAC Address-Addressing in Ethernet

21. SKZ 21 Viewing the MAC Address

22. SKZ 22 Another Layer of Addressing

23. SKZ 23 Ethernet Unicast

24. SKZ 24 Ethernet Broadcast

25. SKZ 25 Ethernet Multicast

26. SKZ Ethernet Access Methods 26

27. SKZ 27 Ethernet Ethernet MAC CSMA/CD

28. SKZ 28 Multi Access Protocols

29. SKZ 29 Ethernet MAC method In a shared media environment, all devices have guaranteed access to the medium but they have no prioritized claim on it.In a shared media environment, all devices have guaranteed access to the medium but they have no prioritized claim on it. If more than one device transmits simultaneouslyIf more than one device transmits simultaneously –The physical signals collide. –The network must recover. Collisions are the cost that Ethernet pays to get the low overhead associated with each transmission.Collisions are the cost that Ethernet pays to get the low overhead associated with each transmission.

30. SKZ 30 CSMA/CD: The Process To transmit, each host will listen on the media.To transmit, each host will listen on the media. –If a signal from another device is present, it will wait for a specific amount of time and listen again. –If no signal is present, it will transmit.

31. SKZ 31 CSMA/CD: The Process It can happen that two devices will determine that it is safe to transmit at exactly the same time.It can happen that two devices will determine that it is safe to transmit at exactly the same time. –In that case, both will transmit their frame. Collision!Collision!

32. SKZ 32 CSMA/CD: The Process Both devices detect the collision and send out a jamming signal.Both devices detect the collision and send out a jamming signal. –The jamming signal is detected by all devices and all devices now know that a collision has occurred on the network.

33. SKZ 33 CSMA/CD: The Process The jamming signal causes each device to invoke a backoff algorithm.The jamming signal causes each device to invoke a backoff algorithm. –Devices wait a random amount of time before returning to listening mode. –The random time ensures that the original devices that caused the collision won’t repeat it.

34. SKZ 34 CSMA/CD: The Process

35. SKZ Ethernet Minimum Frame Size A network using CSMA/CD has a bandwidth of 10 Mbps. If the maximum propagation time (including the delays in the devices and ignoring the time needed to send a jamming signal) is 25.6 μs, what is the minimum size of the frame? 35 Solution:  The frame transmission time is T fr = 2 × T p = 51.2 μs. This means, in the worst case, a station needs to transmit for a period of 51.2 μs to detect the collision.  The minimum size of the frame is 10 Mbps × 51.2 μs = 512 bits or 64 bytes. This is actually the minimum size of the frame for Standard Ethernet.

36. SKZ 36 Ethernet Physical Layer Different Ethernet Standards based on physical layer.Different Ethernet Standards based on physical layer. Ethernet is covered by the IEEE 802.3 standards.Ethernet is covered by the IEEE 802.3 standards. Four data rates over fiber and copper wires:Four data rates over fiber and copper wires: –10 Mbps - 10Base-T Ethernet –100 Mbps - Fast Ethernet –1000 Mbps - Gigabit Ethernet –10 Gbps - 10 Gigabit Ethernet

37. SKZ 37 Ethernet Hubs and Switches

38. SKZ 38 Hubs and Switches Collision Domain:Collision Domain: –The area of a network where collisions can occur. –Includes a hub and all connected devices. –Each port on a switch is considered a separate collision domain even if there is only one device attached to the port. Broadcast Domain:Broadcast Domain: –The area of a network where connected devices can receive a broadcast. –Usually includes Layer 1 and 2 devices. –A router (Layer 3 device) is the usual boundary since routers block broadcasts.

39. SKZ 39 Legacy Ethernet: Using Hubs So, what does a hub do when it receives information? So, what does a hub do when it receives information? Remember, a hub is nothing more than a multiport repeater. Remember, a hub is nothing more than a multiport repeater.

40. SKZ 40 Legacy Ethernet: Using Hubs The hub will flood it out all ports except for the incoming port. The hub will flood it out all ports except for the incoming port. A hub is a Layer 1 device and does NOT look at Layer 2 addresses, so it is fast in transmitting data. A hub is a Layer 1 device and does NOT look at Layer 2 addresses, so it is fast in transmitting data. A hub or series of hubs is called a single Collision Domain. A hub or series of hubs is called a single Collision Domain.

41. SKZ 41 Legacy Ethernet: Using Hubs Disadvantages:Disadvantages: Collision DomainsCollision Domains Wasted BandwidthWasted Bandwidth All ports of the hub share the total available bandwidth.All ports of the hub share the total available bandwidth. Limited ScalabilityLimited Scalability Increased LatencyIncreased Latency Wasted Bandwidth

42. SKZ 42 Legacy Ethernet: Using Hubs Where is the collision domain?

43. SKZ 43 Legacy Ethernet: Using Hubs When a node wishes to communicate with ALL hosts on the network, it sends a BROADCAST frame with a destination MAC address of 0xFFFFFFFFFFFF. When a node wishes to communicate with ALL hosts on the network, it sends a BROADCAST frame with a destination MAC address of 0xFFFFFFFFFFFF. Used in Used in Address Resolution Protocol (ARP) Address Resolution Protocol (ARP) Dynamic Host Configuration Protocol (DHCP) Dynamic Host Configuration Protocol (DHCP)

44. SKZ 44 Legacy Ethernet: Using Hubs Host 1111 sends a broadcast to all nodes on the network.Host 1111 sends a broadcast to all nodes on the network. All hosts recognize the MAC broadcast address and act on the information in the frame.All hosts recognize the MAC broadcast address and act on the information in the frame. Where is the Broadcast Domain?Where is the Broadcast Domain?

45. SKZ 45 Ethernet: Using Switches Switches are also known as learning bridges or learning switches. Switches are also known as learning bridges or learning switches. A switch has a source address table in cache (RAM) where it stores source MAC addresses for each port. A switch has a source address table in cache (RAM) where it stores source MAC addresses for each port.

46. SKZ 46 Ethernet: Using Switches Switch receives an Ethernet frame. Switch receives an Ethernet frame. Searches the source address table for the destination MAC address. Searches the source address table for the destination MAC address.

47. SKZ 47 How does a switch learn an address? First, the switch will see if the SA (1111) is in it’s table. First, the switch will see if the SA (1111) is in it’s table. If it is, it resets a timer. If it is, it resets a timer. If it is NOT in the table it adds it, with the port number. If it is NOT in the table it adds it, with the port number. Next the switch will flood the frame out all other ports, because the DA is not in the source address table. Next the switch will flood the frame out all other ports, because the DA is not in the source address table.

48. SKZ 48 How does a switch learn an address? Most communications involve some sort of client-server relationship or exchange of information. Most communications involve some sort of client-server relationship or exchange of information. Now 3333 sends data back to 1111. Now 3333 sends data back to 1111. The switch sees if it has the SA stored. It does NOT so it adds it. The switch sees if it has the SA stored. It does NOT so it adds it. Next, it checks the DA and sends it out port 1. Next, it checks the DA and sends it out port 1.

49. SKZ 49 How does a switch learn an address? Now, with both MAC addresses in the table, any information between 1111 and 3333 can be sent (selectively forwarded) out the appropriate port. Now, with both MAC addresses in the table, any information between 1111 and 3333 can be sent (selectively forwarded) out the appropriate port.

50. SKZ 50 Multiple Transmissions - No Collisions Unlike a hub, a collision does NOT occur, which would cause the two PCs to have to retransmit the frames. Unlike a hub, a collision does NOT occur, which would cause the two PCs to have to retransmit the frames. The switch buffers the frames and sends them out port #6 one at a time. The switch buffers the frames and sends them out port #6 one at a time. The sending PCs have no idea that there was another PC wanting to send to the same destination. The sending PCs have no idea that there was another PC wanting to send to the same destination.

51. SKZ 51 Collision Domains When there is only one device on a switch port, the collision domain is only between the PC and the switch. When there is only one device on a switch port, the collision domain is only between the PC and the switch.

52. SKZ 52 What happens here? Notice the Source Address Table has multiple entries for port 1. Notice the Source Address Table has multiple entries for port 1. The switch selectively forwards the frame out port #1. The switch selectively forwards the frame out port #1.

53. SKZ 53 What happens here? But the hub is only a layer 1 device, so a hub floods it out all ports. But the hub is only a layer 1 device, so a hub floods it out all ports. How many collision domains exist?

54. SKZ 54 What happens here? Notice the Source Address Table has multiple entries for port 1. Notice the Source Address Table has multiple entries for port 1. Does that matter in this case? Does that matter in this case?

55. SKZ 55 What happens here? The switch is a Layer 2 device so the broadcast frame is sent out all of the ports. The switch is a Layer 2 device so the broadcast frame is sent out all of the ports. The hubs are Layer 1 devices and also forward the frame. The hubs are Layer 1 devices and also forward the frame. Broadcast Domain

56. SKZ 56 Ethernet Address Resolution Protocol (ARP)

57. SKZ 57 Resolving IPv4 addresses to MAC Addresses Two address types: Two address types: MAC address:MAC address: Physical address of the hostPhysical address of the host Burned in to the NICBurned in to the NIC Layer 2 addressLayer 2 address Network Address:Network Address: Logical address of the hostLogical address of the host Assigned by network administratorAssigned by network administrator Layer 3 addressLayer 3 address

58. SKZ 58 Resolving IPv4 addresses to MAC Addresses So…..How do we obtain both addresses to build the packets and frames? So…..How do we obtain both addresses to build the packets and frames? MAC Address: ARP (Address Resolution Protocol)MAC Address: ARP (Address Resolution Protocol) IP Address: Static and DynamicIP Address: Static and Dynamic

59. SKZ 59 Resolving IPv4 addresses to MAC Addresses Address Resolution Protocol (ARP): Address Resolution Protocol (ARP): Why do devices need to map a MAC address to an IP address? There is no built-in connection or relationship between the MAC (physical) address and the assigned IP (logical) address. IP hosts and routers use Address Resolution Protocol (ARP) to resolve a known IP address to the corresponding MAC address.

60. SKZ 60 The ARP Process: The Same Subnet

61. SKZ 61 The ARP Process: Different Subnet

62. SKZ 62 The ARP Process: Removing Mappings

63. SKZ 63 The ARP Process: Issues Overhead on the Media: Overhead on the Media: As a broadcast frame, an ARP request is received and processed by every device on the local network. As a broadcast frame, an ARP request is received and processed by every device on the local network. Usually minimal but can be significant if all users and devices were to power up and start using network services at the same time. Usually minimal but can be significant if all users and devices were to power up and start using network services at the same time.

64. SKZ 64 The ARP Process: Issues Security: Security: ARP spoofing, or ARP poisoning, is a technique used by an attacker to inject the wrong MAC address association into a network by issuing fake ARP requests. ARP spoofing, or ARP poisoning, is a technique used by an attacker to inject the wrong MAC address association into a network by issuing fake ARP requests. An attacker forges the MAC address of a device and then frames can be sent to the wrong destination. An attacker forges the MAC address of a device and then frames can be sent to the wrong destination.