Chapter 5: Ethernet

Ethernet is now the predominant LAN technology in the world.

The Ethernet protocol standards define many aspects of network communication including:

 Frame format
 Frame size
 Timing
 Encoding

Ethernet Encapsulation
Ethernet operates in the DATA LINK LAYER AND THE PHYSICAL LAYER.

It is a family of networking technologies that are defined in the IEEE 802.2 and 802.3 standard.

Ethernet supports data bandwidths of:

 10 Mb/s

 100 Mb/s

 1000 Mb/s (1 Gb/s)

 10,000 Mb/s (10 Gb/s)

 40,000 Mb/s (40 Gb/s)

 100,000 Mb/s (100 Gb/s)

Ethernet standards define both the Layer 2 protocols and the Layer 1 technologies.

For the Layer 2 protocols, as with all 802 IEEE standards, Ethernet relies on the two separate
sublayers of the DATA LINK LAYER to operate:

1. THE LOGICAL LINK CONTROL (LLC) and

2. THE MAC SUBLAYERS.

LLC sublayer

The Ethernet LLC sublayer handles the communication between the upper layers and the lower
layers. This is typically between the networking software and the device hardware.
The LLC sublayer takes the network protocol data, which is typically an IPv4 packet, and
adds CONTROL INFORMATION to help deliver the packet to the destination node.

The LLC is used to communicate with the upper layers of the application, and transition
the packet to the lower layers for delivery.

LLC is implemented in software, and its implementation is independent of the hardware.

In a computer, the LLC can be considered the driver software for the NIC. The NIC driver is
a program that interacts directly with the hardware on the NIC to pass the data between
the MAC SUBLAYER AND THE PHYSICAL MEDIA.

MAC sublayer

MAC constitutes the lower sublayer of the data link layer

MAC is implemented by hardware, typically in the computer NIC

MAC Sublayer
The Ethernet MAC sublayer has two primary responsibilities:

 Data encapsulation

 Media access control

Data encapsulation

The data encapsulation process includes:

 Frame assembly before transmission.

 Frame disassembly upon reception of a frame.
 In forming the frame, the MAC layer adds a header and trailer to the network layer PDU.
 Data encapsulation provides three primary functions
1. Frame delimiting: The framing process provides important delimiters that are used
to identify a group of bits that make up a frame. These delimiting bits provide
synchronization between the transmitting and receiving nodes
2. Addressing: The encapsulation process contains the Layer 3 PDU and also provides
for DATA LINK LAYER ADDRESSING.
3. Error detection: Each frame contains a trailer used to detect any errors in
transmissions.

The use of frames aids in the transmission of bits as they are placed on the media and in the grouping
of bits at the receiving node

Media Access Control

The second responsibility of the MAC sublayer is MEDIA ACCESS CONTROL.

MEDIA ACCESS CONTROL is responsible for:

1. The placement of frames on the media and

2. The removal of frames from the media

This sublayer communicates directly with the physical layer.

The LOGICAL TOPOLOGY OF ETHERNET is: a multi-access bus; therefore, all nodes (devices) on a
single network segment share the medium.

ETHERNET is a Contention-Based Method Of Networking. A contention-based method means that

any device can try to transmit data across the shared medium whenever it has data to send.
The Carrier Sense Multiple Access/Collision Detection (CSMA/CD) process is used in half-duplex
Ethernet LANs to detect and resolve collisions. Today’s Ethernet LANs use full-duplex switches,
which allow multiple devices to send and receive simultaneously with no collisions.

Ethernet Frame Fields

THE MINIMUM ETHERNET FRAME SIZE IS 64 Bytes AND THE MAXIMUM IS 1518 Bytes. This includes
all bytes from the Destination MAC Address field through the Frame Check Sequence (FCS) field. The
Preamble field is not included when describing the size of a frame.

Frame < 64 bytes in length is considered a: “Collision Fragment” Or “Runt Frame” and is
automatically discarded by receiving stations,

Frames > 1500 bytes of data are considered: “jumbo” or “baby giant frames”.

If the size of a transmitted frame is less than the minimum or greater than the maximum, the
receiving device drops the frame. Dropped frames are likely to be the result of collisions or other
unwanted signals and are therefore considered invalid.
Ehernet II - Frame Fields:

1. Preamble And Start Frame Delimiter Fields (SFD):

 The preamble (7 bytes)
 Star Frame Delimiter (SFD) also called the Start of Frame (1 byte),
 Fields are used for synchronization between the sending and receiving device.
 Essentially, the first few bytes tell the receiver to get ready to receive a new frame.

2. Destination Mac Address Field:

 This 6-bytes is the identifier recipient.
 This address is used by LAYER 2 to assist devices in determining if a frame is
addresses to them. The address in the frame is compared to the MAC ADDRESS IN
THE DEVICE. If there are a match, the device accepts the frame.
 Can be a Unicast, Multicast or Broadcast Address.

3. Source Mac Address Field:

 This 6-bytes is the identifier the frame´s originating NIC o Interface.
 Must be a Unicast Address.

4. EtherType Field:
 This 2-byte field identified the upper layer protocol encapsulate in the Ethernet
Frame.
 Common Values are:
0x800 for IPv4.
0x86DD for IPv6.
0x806 for ARP.

5. DATA FIELD:
 This Field ( 46 – 1500 bytes)
 Contains the encapsulated data from:
i. A Higher Layer,
ii. Generic Layer 3 PDU o commonly an IPv4 Packet.

6. Frame Check Sequence Field: This Field ( 4 bytes) is used to detect errors in a frame.
MAC Address and Hexadecimal
An Ethernet MAC address is a 48-bit binary value expressed as 12 hexadecimal digits (4 bits per
hexadecimal digit).

Just as decimal is a base ten number system, hexadecimal is a base sixteen system. The base sixteen
number system uses the numbers 0 to 9 and the letters A to F

MAC Address: Ethernet Identity

In Ethernet, every network device is connected to the same, shared media

Ethernet was once predominantly a half-duplex topology using a multi-access bus or later Ethernet
hubs. This meant that all nodes would receive every frame transmitted. To prevent the excessive
overhead involved in the processing of every frame, MAC addresses were created to identify the
actual source and destination

MAC addressing: provides a method for device identification at the lower level of the OSI
model.

The MAC address value is a direct result of IEEE-enforced rules for vendors to ensure
globally unique addresses for each Ethernet device

The rules established by IEEE require any vendor that sells Ethernet devices to register with IEEE.

The IEEE assigns the vendor a 3-byte (24-bit) code, called the Organizationally Unique Identifier
(OUI)

IEEE requires a vendor to follow two simple rules:

1. All MAC addresses assigned to a NIC or other Ethernet device must use that vendor's
assigned OUI as the first 3 bytes
2. All MAC addresses with the same OUI must be assigned a unique value in the last 3 bytes.
Switch Fundamentals
A Layer 2 Ethernet switch uses MAC addresses to make forwarding decisions.

The switch makes its forwarding decisions based only on the Layer 2 Ethernet MAC addresses.

Unlike legacy Ethernet hubs that repeat bits out all ports except the incoming port, an Ethernet
switch consults a MAC address table to make a forwarding decision for each frame.

The MAC address table is sometimes referred to as a content addressable memory (CAM) table

Learning MAC Addresses

The switch dynamically builds the MAC address table by examining the source MAC address of the
frames received on a port

The switch forwards frames by searching for a match between the destination MAC address in the
frame and an entry in the MAC address table

The following process is performed on every Ethernet frame that enters a switch.

Every frame that enters a switch is checked for new information to learn.

It does this by examining the frame’s source MAC address and port number where the frame
entered the switch.

 IF THE SOURCE MAC ADDRESS does not exist, it is added to the table along with the
incoming port number
 IF THE SOURCE MAC ADDRESS does exist, the switch updates the refresh timer for that
entry. By default, most Ethernet switches keep an entry in the table for 5 minutes
 Note: If the source MAC address does exist in the table but on a different port, the switch
treats this as a new entry. The entry is replaced using the same MAC address but with the
more current port number

Forward – Examining the Destination MAC Address

IF THE DESTINATION MAC ADDRESS IS A UNICAST ADDRESS, the switch will look for a match
between the destination MAC address of the frame and an entry in its MAC address table:

 IF THE DESTINATION MAC ADDRESS IS IN THE TABLE, it will forward the frame out the
specified port
 IF THE DESTINATION MAC ADDRESS IS NOT IN THE TABLE, the switch will forward the frame
out all ports except the incoming port. This is known as an unknown unicast.
 Note: IF THE DESTINATION MAC ADDRESS IS A BROADCAST OR A MULTICAST, the frame
is also flooded out all ports except the incoming port.
Frame Forwarding Methods on Cisco
Switches
Switches use one of the following forwarding methods for switching data between network ports:

1. Store-and-forward switching
2. Cut-through switching

IN STORE-AND-FORWARD SWITCHING, when the switch receives the frame, it stores the data in
buffers until the complete frame has been received. During the storage process, the switch
analyzes the frame for information about its destination. In this process, the switch also performs
an error check using the Cyclic Redundancy Check (CRC) trailer portion of the Ethernet frame.

CUT-THROUGH SWITCHING, the switch acts upon the data as soon as it is received, even if
the transmission is not complete.

THE SWITCH BUFFERS JUST ENOUGH OF THE FRAME TO READ THE DESTINATION MAC ADDRESS
SO THAT IT CAN DETERMINE TO WHICH PORT TO FORWARD THE DATA

The switch looks up the destination MAC address in its switching table, determines the outgoing
interface port, and forwards the frame onto its destination through the designated switch port
The switch does not perform any error checking on the frame.

There are two variants of cut-through switching:

 Fast-forward switching - Fast-forward switching offers the lowest level of latency. Fast-
forward switching immediately forwards a packet after reading the destination address.
Because fast-forward switching starts forwarding before the entire packet has been
received there may be times when packets are relayed with errors.
 Fragment-free switching - In fragment-free switching, the switch stores the first 64 bytes of
the frame before forwarding
o Fragment-free switching can be viewed as a compromise between store-and-
forward switching and fast-forward switching
o The reason fragment-free switching stores only the first 64 bytes of the frame is
that most network errors and collisions occur during the first 64 bytes
o Fragment-free switching tries to enhance fast-forward switching by performing a
small error check on the first 64 bytes of the frame to ensure that a collision has not
occurred before forwarding the frame
o Fragment-free switching is a compromise between the high latency and high
integrity of store-and-forward switching, and the low latency and reduced integrity
of fast-forward switching.

Some switches are configured to perform cut-through switching on a per-port basis until a user-
defined error threshold is reached, and then they automatically change to store-and-forward

When the error rate falls below the threshold, the port automatically changes back to cut-through
switching

Memory Buffering on Switches

An Ethernet switch may use a buffering technique to store frames before forwarding them

Buffering may also be used when the destination port is busy due to congestion and the switch
stores the frame until it can be transmitted.

There are two methods of memory buffering:

1. Port-based Memory Buffering:

a. In port-based memory buffering, frames are stored in queues that are linked to
specific incoming and outgoing ports.
b. A frame is transmitted to the outgoing port only when all the frames ahead of it in
the queue have been successfully transmitted
c. It is possible for a single frame to delay the transmission of all the frames in memory
because of a busy destination port. This delay occurs even if the other frames could
be transmitted to open destination ports.
2. Shared Memory Buffering:
a. Shared memory buffering deposits all frames into a common memory buffer that
all the ports on the switch share
Duplex and Speed Settings
Two of the most basic settings on a switch are the bandwidth and duplex settings for each
individual switch port.

It is critical that the duplex and bandwidth settings match between the switch port and the
connected devices, such as a computer or another switch.

There are two types of duplex settings used for communications on an Ethernet network:
half duplex and full duplex.

 Full-duplex – Both ends of the connection can send and receive simultaneously.

 Half-duplex – Only one end of the connection can send at a time.

Auto-negotiation is an optional function found on most Ethernet switches and NICs.

Auto-negotiation enables two devices to automatically exchange information about speed and
duplex capabilities. The switch and the connected device will choose the highest performance
mode. Full-duplex is chosen if both devices have the capability along with their highest common
bandwidth

Duplex Mismatch

One of the most common causes of performance issues on 10/100 Mb/s Ethernet links
occurs when one port on the link operates at half-duplex while the other port operates at
full-duplex

This occurs when one or both ports on a link are reset, and the Auto-negotiation process does not
result in both link partners having the same configuration.

It also can occur when users reconfigure one side of a link and forget to reconfigure the other. Both
sides of a link should have Auto negotiation on, or both sides should have it off.

Auto-MDIX
In addition to having the correct duplex setting, it is also necessary to have the correct cable type
defined for each port.

Connections between specific devices,

 SWITCH-TO-SWITCH
 SWITCH-TO-ROUTER
 SWITCH-TO-HOST,
 ROUTER-TO-HOST DEVICES
Most switch devices now support the MDIX AUTO INTERFACE configuration command in the CLI to
enable the automatic medium-dependent interface crossover (auto-MDIX) feature

When the AUTO-MDIX FEATURE IS ENABLED, the switch detects the type of cable attached to the
port, and configures the interfaces accordingly. Therefore, you can use either a crossover or a
straight-through cable for connections to a copper 10/100/1000 port on the switch, regardless of
the type of device on the other end of the connection.

Note: The auto-MDIX feature is enabled by default on switches running Cisco IOS Release 12.2(18)SE
or later.
Introduction to ARP
To determine the destination MAC address, the device uses ARP

ARP provides two basic functions:

1. Resolving IPv4 addresses to MAC addresses

2. Maintaining a table of mappings

Resolving IPv4 Addresses to MAC Addresses

When a packet is sent to the DATA LINK LAYER to be encapsulated into an Ethernet frame, the
device refers to a table in its memory to find the MAC address that is mapped to the IPv4 address.
This table is called the ARP table or the ARP cache. The ARP table is stored in the RAM of the device

The sending device will search its ARP table for a destination IPv4 address and a corresponding MAC
address:

 IF the packet’s destination IPv4 address is on the same network as the source IPv4
address, the device will search the ARP table for the destination IPv4 address
 IF the destination IPv4 address is on a different network than the source IPv4 address, the
device will search the ARP table for the IPv4 address of the default gateway.
 In both cases, the search is for an IPv4 address and a corresponding MAC address for the
device.

EACH ENTRY, OR ROW, OF THE ARP TABLE BINDS AN IPV4 ADDRESS WITH A MAC ADDRESS.

We call the relationship between the two values a map - it simply means that you can locate an
IPv4 address in the table and discover the corresponding MAC address

The ARP table temporarily saves (caches) the mapping for the devices on the LAN.

If the device locates the IPv4 address, its corresponding MAC address is used as the destination
MAC address in the frame. IF there is no entry is found, then the device sends an ARP request.
ARP Request
An ARP request is sent when a device needs a MAC address associated with an IPv4 address, and it
does not have an entry for the IPv4 address in its ARP table

ARP messages are encapsulated directly within an Ethernet frame. There is no IPv4 header. The
ARP request message includes:

 Target IPv4 address: This is the IPv4 address that requires a corresponding MAC address.
 Target MAC address: This is the unknown MAC address and will be empty in the ARP
request message

The ARP request is encapsulated in an Ethernet frame using the following header information:

 Destination MAC address – This is a broadcast address requiring all Ethernet NICs on the
LAN to accept and process the ARP request
 Source MAC address – This is the sender of the ARP request’s MAC address
 Type - ARP messages have a type field of 0x806. This informs the receiving NIC that the data
portion of the frame needs to be passed to the ARP process.

ARP requests are broadcasts; they are flooded out all ports by the switch except the receiving port.
All Ethernet NICs on the LAN process broadcasts. Every device must process the ARP request to see
if the target IPv4 address matches its own.

A router will not forward broadcasts out other interfaces

Only one device on the LAN will have an IPv4 address that matches the target IPv4 address in the
ARP request. All other devices will not reply.
ARP Reply
Only the device with an IPv4 address associated with the target IPv4 address in the ARP request will
respond with an ARP reply

The ARP reply message includes:

 Sender’s IPv4 address: This is the IPv4 address of the sender, the device whose MAC
address was requested.
 Sender’s MAC address: This is the MAC address of the sender, the MAC address needed
by the sender of the ARP request

The ARP reply is encapsulated in an Ethernet frame using the following header information:

 Destination MAC address – This is the MAC address of the sender of the ARP request.
 Source MAC address – This is the sender of the ARP reply’s MAC address
 Type - ARP messages have a type field of 0x806. This informs the receiving NIC that the data
portion of the frame needs to be passed to the ARP process.
ARP Role in Remote Communication
When the destination IPv4 address is not on the same network as the source IPv4 address, the
source device needs to send the frame to its default gateway. This is the interface of the local router.
Whenever a source device has a packet with an IPv4 address on another network, it will encapsulate
that packet in a frame using the destination MAC address of the router

Removing Entries from an ARP Table

For each device, an ARP cache timer removes ARP entries that have not been used for a specified
period of time. The times differ depending on the device’s operating system. For example, some
Windows operating systems store ARP cache entries for 2 minutes

ARP Broadcasts
On a typical business network, these broadcasts would probably have minimal impact on network
performance. However, if a large number of devices were to be powered up and all start accessing
network services at the same time, there could be some reduction in performance for a short period
of time.

ARP Spoofing
In some cases, the use of ARP can lead to a potential security risk known as ARP spoofing
or ARP poisoning. This is a technique used by an attacker to reply to an ARP request for an
IPv4 address belonging to another device, such as the default gateway, as shown in the
figure. The attacker sends an ARP reply with its own MAC address. The receiver of the
ARP reply will add the wrong MAC address to its ARP table and send these packets to the
attacker.

Enterprise level switches include mitigation techniques known as dynamic ARP inspection
(DAI). DAI is beyond the scope of this course