Module 6: Ethernet Fundamentals - PowerPoint PPT Presentation


PPT – Module 6: Ethernet Fundamentals PowerPoint presentation | free to download - id: 7b55a6-YTI2Y


The Adobe Flash plugin is needed to view this content

Get the plugin now

View by Category
About This Presentation

Module 6: Ethernet Fundamentals


Module 6: Ethernet Fundamentals James Chen – PowerPoint PPT presentation

Number of Views:14
Avg rating:3.0/5.0
Slides: 40
Provided by: VAIO77


Write a Comment
User Comments (0)
Transcript and Presenter's Notes

Title: Module 6: Ethernet Fundamentals

Module 6 Ethernet Fundamentals
  • James Chen

  • Ethernet Fundamentals
  • Introduction to Ethernet
  • IEEE Ethernet naming rules
  • Ethernet and the OSI model
  • Naming
  • Layer 2 framing, Ethernet frame fields
  • Ethernet frame structure
  • Ethernet Operation
  • Media Access Control (MAC)
  • MAC rules and collision detection/backoff
  • Ethernet timing
  • Interframe spacing and backoff
  • Error handling
  • Types of collisions
  • Ethernet errors
  • FCS and beyond
  • Ethernet auto-negotiation
  • Link establishment and full and half duplex

  • 6.1 Ethernet Fundamentals

Introduction to Ethernet
  • The success of Ethernet is due to the following
  • Simplicity and ease of maintenance
  • Ability to incorporate (??)new technologies
  • Reliability
  • Low cost of installation and upgrade
  • The original idea for Ethernet grew out of the
    problem of allowing two or more hosts to use the
    same medium and prevent the signals from
    interfering with each other.
  • This problem of multiple user access to a shared
    medium was studied in the early 1970s at the
    University of Hawaii.
  • A system called Alohanet was developed to allow
    various stations on the Hawaiian Islands
    structured access to the shared radio frequency
    band in the atmosphere.
  • This work later formed the basis for the Ethernet
    access method known as CSMA/CD.
  • The first Ethernet standard was published in 1980
    by a consortium of Digital Equipment Company,
    Intel, and Xerox (DIX).
  • In 1995, IEEE announced a standard for a 100-Mbps
  • In 1999, 1Gbps Ethernet.
  • Now, 10Gbps Ethernet

IEEE Ethernet naming rules
  • When Ethernet needs to be expanded to add a new
    medium or capability, the IEEE issues a new
    supplement to the 802.3 standard.
  • Naming Rule
  • Speed 10, 100, 1G, 10G
  • Signal method BASE, BROAD
  • Medium 2, 5, T, TX, FX, CX, SX, LX, ZX

IEEE Ethernet naming rules (cont.)
Ethernet and the OSI model
  • Ethernet operates in two areas of the OSI model
  • the lower half of the data link layer (MAC
    sublayer )
  • physical layer.

Ethernet and the OSI model (cont.)
  • Repeater
  • A repeater is responsible for forwarding all
    traffic to all other ports.
  • Traffic received by a repeater is never sent out
    the originating port.
  • If the signal is degraded through attenuation or
    noise, the repeater will attempt to reconstruct
    and regenerate the signal.
  • A collision domain is then a shared resource.
  • Problems originating in one part of the collision
    domain will usually impact the entire collision
  • Stations separated by repeaters are within the
    same collision domain.
  • Stations separated by bridges or routers are in
    different collision domains.

Ethernet and the OSI model (cont.)
  • Ethernet Layer 1 involves interfacing with media,
    signals, bit streams that travel on the media,
    components that put signals on media, and various
  • Ethernet Layer 1 performs a key role in the
    communication that takes place between devices,
    but each of its functions has limitations.
  • Layer 2 addresses these limitations.

Ethernet and the OSI model (cont.)
  • Data link sublayers contribute significantly to
    technology compatibility and computer
  • The MAC sublayer is concerned with the physical
    components that will be used to communicate the
  • The Logical Link Control (LLC) sublayer remains
    relatively independent of the physical equipment
    that will be used for the communication process.

  • To allow for local delivery of frames on the
    Ethernet, there must be an addressing system, a
    way of uniquely identifying computers and
  • Ethernet uses MAC addresses that are 48 bits in
    length and expressed as twelve hexadecimal digits
    (6 Bytes).
  • MAC addresses are sometimes referred to as
    burned-in addresses (BIA) because they are burned
    into read-only memory (ROM) and are copied into
    random-access memory (RAM) when the NIC

Naming (cont.)
  • At the data link layer MAC headers and trailers
    are added to upper layer data.
  • The header and trailer contain control
    information intended (???)for the data link layer
    in the destination system.
  • The NIC uses the MAC address to assess(??)whether
    the message should be passed onto the upper
    layers of the OSI model.
  • The NIC makes this assessment without using CPU
    processing time, enabling better communication
    times on an Ethernet network.
  • On an Ethernet network, when one device sends
    data it can open a communication pathway to the
    other device by using the destination MAC
  • All devices that are connected to the Ethernet
    LAN have MAC addressed interfaces including
    workstations, printers, routers, and switches.

Layer 2 framing
  • Framing is the Layer 2 encapsulation process.
  • Voltage vs. time graph (large and confusing)
  • Frame format diagram (fields groupings of bits)
  • Preamble field
  • The pattern of ones and zeroes used for timing
    synchronization in 10 Mbps Ethernet
  • The timing information is redundant but retained
    for compatibility in faster versions of Ethernet
  • Start Frame Delimiter field
  • It consists of a one-octet field that marks the
    end of the timing information, and contains the
    bit sequence 10101011.
  • Destination field
  • Destination node MAC address (unicast, multicast
    (group), broadcast (all nodes))
  • Source field
  • Source node MAC address (unicast address, virtual
  • Length field / type field
  • length of a frame in bytes (it implies the end)
  • some frames have a type field, which specifies
    the Layer 3 protocol making the sending request.

Layer 2 framing (cont.)
  • Data field
  • upper layer data
  • user application data
  • LLC bytes are also included with the data field
    in the IEEE standard frames.
  • It adds control information to help deliver that
    IP packet to the destination node.
  • Layer 2 communicates with the upper-level layers
    through LLC.
  • padding bytes (minimum length for timing
  • FCS field (Frame Check Sequence number)
  • End of the frame.
  • It contains a number that is calculated by the
    source node based on the data in the frame.
  • When the destination node receives the frame the
    FCS number is recalculated and compared with the
    FCS number included in the frame.
  • If the two numbers are different, an error is
    assumed, the frame is discarded, and the source
    is asked to retransmit.
  • The ways to calculate the FCS number
  • Cyclic Redundancy Check (CRC) performs
    calculations on the data.
  • Two-dimensional parity adds an 8th bit that
    makes an 8 bit sequence have an odd or even
    number of binary 1s.
  • Internet checksum adds the values of all of the
    data bits to arrive at a sum.

Layer 2 framing (cont.)
Ethernet frame structure
Ethernet frame structure (cont.)
Ethernet frame structure (cont.)
  • The Ethernet II Type field is incorporated into
    the current 802.3 frame definition.
  • If the value of Length/Type field is equal to or
    greater than 1536 or 0x600 (hexadecimal), then
    the frame is interpreted according to the
    Ethernet II type code indicated.
  • The maximum transmission unit (MTU) for Ethernet
    is 1500 octets
  • minimum-sized frame 64B (preamble is not
  • Ethernet requires each frame to be between 64 and
    1518 octets

  • Ethernet Operation

Media Access Control (MAC)
  • Categories of Media Access Control
  • Deterministic(????)(taking turns)
  • In a Token Ring network, individual hosts are
    arranged in a ring and a special data token
    travels around the ring to each host in sequence.
    When a host wants to transmit, it seizes the
    token, transmits the data for a limited time, and
    then forwards the token to the next host in the
    ring. Token Ring is a collisionless environment
    as only one host is able to transmit at any given
  • Non-deterministic (first come, first served)
  • In a CSMA/CD system, the NIC listens for an
    absence of a signal on the media and starts
    transmitting. If two nodes transmit at the same
    time a collision occurs and none of the nodes are
    able to transmit.
  • Ethernet logical bus topology, physical star or
    extended star, wired as a star
  • Token Ring logical ring topology, physical star
    topology, wired as a star
  • FDDI logical ring topology, physical dual-ring
    topology, wired as a dual-ring

MAC rules and collision detection/backoff
  • In the CSMA/CD access method, networking devices
    with data to transmit work in a
    listen-before-transmit mode. This means when a
    node wants to send data, it must first check to
    see whether the networking media is busy. If the
    node determines the network is busy, the node
    will wait a random amount of time before
    retrying. If the node determines the networking
    media is not busy, the node will begin
    transmitting and listening. The node listens to
    ensure no other stations are transmitting at the
    same time. After completing data transmission the
    device will return to listening mode.
  • Networking devices detect a collision has
    occurred when the amplitude of the signal on the
    networking media increases. When a collision
    occurs, each node that is transmitting will
    continue to transmit for a short time to ensure
    that all devices see the collision. Once all the
    devices have detected the collision a backoff
    algorithm is invoked and transmission is stopped.
    The nodes stop transmitting for a random period
    of time, which is different for each device. When
    the delay period expires, all devices on the
    network can attempt to gain access to the
    networking media. When data transmission resumes
    (??)on the network, the devices that were
    involved in the collision do not have priority to
    transmit data.

MAC rules and collision detection/backoff (cont.)
MAC rules and collision detection/backoff (cont.)
Ethernet timing
  • In half duplex, assuming that a collision does
    not occur, the sending station will transmit 64
    bits of timing synchronization information that
    is known as the preamble. The sending station
    will then transmit the following information
  • Destination and source MAC addressing information
  • Certain other header information (Length / Type)
  • The actual data payload (Data)
  • Checksum (FCS)
  • 10 Mbps and slower versions of Ethernet are
    asynchronous. Asynchronous means that each
    receiving station will use the eight octets of
    timing information to synchronize the receive
    circuit to the incoming data, and then discard
  • If the attached station is operating in full
    duplex then the station may send and receive
    simultaneously and collisions should not occur.
  • Full-duplex operation also changes the timing
    considerations and eliminates the concept of slot
  • Full-duplex operation allows for larger network
    architecture designs since the timing restriction
    for collision detection is removed.
  • 100 Mbps and higher speed implementations of
    Ethernet are synchronous. Synchronous means the
    timing information is not required, however for
    compatibility reasons the Preamble and SFD are

Ethernet timing (cont.)
  • For all speeds of Ethernet transmission at or
    below 1000 Mbps, the standard describes how a
    transmission may be no smaller than the slot
  • Slot time for 10 and 100-Mbps Ethernet is 512
    bit-times, or 64 octets.
  • Slot time for 1000-Mbps Ethernet is 4096
    bit-times, or 512 octets.
  • Slot time is calculated assuming maximum cable
    lengths on the largest legal network
    architecture. All hardware propagation delay
    times are at the legal maximum and the 32-bit jam
    signal is used when collisions are detected.
  • The actual calculated slot time is just longer
    than the theoretical amount of time required to
    travel between the furthest points of the
    collision domain, collide with another
    transmission at the last possible instant, and
    then have the collision fragments return to the
    sending station and be detected. For the system
    to work the first station must learn about the
    collision before it finishes sending the smallest
    legal frame size.
  • To allow 1000-Mbps Ethernet to operate in half
    duplex the extension field was added when sending
    small frames purely to keep the transmitter busy
    long enough for a collision fragment to return.
    This field is present only on 1000-Mbps,
    half-duplex links and allows minimum-sized frames
    to be long enough to meet slot time requirements.
    Extension bits are discarded by the receiving
  • On 10-Mbps Ethernet one bit at the MAC layer
    requires 100 ns to transmit. At 100 Mbps that
    same bit requires 10 ns to transmit and at 1000
    Mbps only takes 1 ns.

Ethernet timing (cont.)
  • As a rough estimate, 20.3 cm (8 inch) per
    nanosecond is often used for calculating
    propagation delay down a UTP cable. For 100
    meters of UTP, this means that it takes just
    under 5 bit-times for a 10BASE-T signal to travel
    the length the cable.
  • 100 m / 20.3 cm per ns 492.6 ns
  • 492.6 ns / 100 ns per bit 5 bits
  • For CSMA/CD Ethernet to operate, the sending
    station must become aware of a collision before
    it has completed transmission of a minimum-sized
    frame. At 100 Mbps the system timing is barely
    (??)able to accommodate 100 meter cables. At 1000
    Mbps special adjustments are required as nearly
    an entire minimum-sized frame would be
    transmitted before the first bit reached the end
    of the first 100 meters of UTP cable. For this
    reason half duplex is not permitted in 10-Gigabit

Interframe spacing and backoff
  • The minimum spacing between two non-colliding
    frames is also called the interframe spacing.
  • This is measured from the last bit of the FCS
    field of the first frame to the first bit of the
    preamble of the second frame.
  • Ethernet devices must allow a minimum idle period
    between transmission of frames known as the
    spacing gap. It provides a brief recovery time
    between frames to allow devices to prepare for
    reception of the next frame.
  • The minimum spacing gap is 96 bit times, which is
    9.6 microseconds for 10 Mb/s Ethernet, 960
    nanoseconds for 100 Mb/s Ethernet, and 96
    nanoseconds for 1 Gb/s Ethernet.
  • http//

Interframe spacing and backoff (cont.)
  • After a collision occurs and all stations allow
    the cable to become idle (each waits the full
    interframe spacing)
  • The stations that collided must wait an
    additional longer period of time before
    attempting to retransmit the collided frame.
  • The waiting period is intentionally designed to
    be random so that two stations do not delay for
    the same amount of time before retransmitting,
    which would result in more collisions.
  • If the MAC layer is unable to send the frame
    after sixteen attempts, it gives up and generates
    an error to the network layer. Such an occurrence
    is fairly rare and would happen only under
    extremely heavy network loads, or when a physical
    problem exists on the network.
  • The slot time is a key parameter for half-duplex
    Ethernet network operation. It is defined as 512
    bit times for Ethernet networks operating at 10
    and 100 Mb/s, and 4096 bit times for gigabit
  • Backoff is the process by which a transmitting
    interface determines how long to wait following a
    collision before attempting to retransmit the

Error handling
  • The most common error condition on an Ethernet is
    the collision.
  • Collisions are the mechanism for resolving
    contention for network access.
  • Collisions result in network bandwidth loss that
    is equal to the initial transmission and the
    collision jam signal (32 bits), all stations have
    a chance to detect the collision.
  • Jam signal is simply a repeating one, zero, one,
    zero pattern, the same as Preamble. When viewed
    by a protocol analyzer this pattern appears as
    either a repeating hexadecimal 5 or A sequence.

Error handling (cont.)
Types of collisions
  • To create a local collision on coax cable
    (10BASE2 and 10BASE5), the signal travels down
    the cable until it encounters (??)a signal from
    the other station.
  • The waveforms then overlap, canceling some parts
    of the signal out and reinforcing or doubling
    other parts.
  • The doubling of the signal pushes the voltage
    level of the signal beyond the allowed maximum.
    This over-voltage condition is then sensed by all
    of the stations on the local cable segment as a
  • In the beginning the waveform in Figure
    represents normal Manchester encoded data.
  • A few cycles into the sample the amplitude of the
    wave doubles. That is the beginning of the
    collision, where the two waveforms are
    overlapping. Just prior to the end of the sample
    the amplitude returns to normal.
  • This happens when the first station to detect the
    collision quits transmitting, and the jam signal
    from the second colliding station is still

Types of collisions (cont.)
  • Collisions are only recognized on UTP when the
    station is operating in half duplex.
  • If the station is not engaged in transmitting it
    cannot detect a local collision. Conversely(???),
    a cable fault such as excessive crosstalk can
    cause a station to perceive(??)its own
    transmission as a local collision.
  • A remote collision usually results from
    collisions occurring on the far side of a
    repeated connection.
  • A repeater will not forward an over-voltage
    state, and cannot cause a station to have both
    the TX and RX pairs active at the same time.
  • Collisions occurring after the first 64 octets
    are called late collisions".
  • The most significant difference between late
    collisions and collisions occurring before the
    first 64 octets is that the Ethernet NIC will
    retransmit a normally collided frame
    automatically, but will not automatically
    retransmit a frame that was collided late.
  • As far as the NIC is concerned everything went
    out fine, and the upper layers of the protocol
    stack must determine that the frame was lost.
    Other than retransmission, a station detecting a
    late collision handles it in exactly the same way
    as a normal collision.

Ethernet errors
  • The following are the sources of Ethernet error
  • Collision or runt Simultaneous transmission
    occurring before slot time has elapsed (??)
  • Late collision Simultaneous transmission
    occurring after slot time has elapsed
  • Jabber(????), long frame and range errors
    Excessively or illegally long transmission 
  • Short frame, collision fragment or runt
    Illegally short transmission
  • FCS error Corrupted (??)transmission
  • Alignment error Insufficient or excessive
    number of bits transmitted
  • Range error Actual and reported number of
    octets in frame do not match
  • Ghost or jabber Unusually long Preamble or Jam
  • Jabber and Long Frames
  • Jabber at least 20,000 to 50,000 bit times in
  • Long Frames excess of the maximum frame size
    (1518 octets)
  • both significantly larger
  • whether or not the frame was tagged
  • whether or not the frame had a valid FCS checksum

Ethernet errors (cont.)
  • Short frames
  • less than the minimum frame size (64 octets)
  • with valid(???)FCS checksums
  • Some protocol analyzers and network monitors call
    these frames runts".
  • The term runt is generally an imprecise
    slang(??)term that means something less than a
    legal frame size. It may refer to short frames
    with a valid FCS checksum although it usually
    refers (???)to collision fragments.

FCS and beyond
  • A received frame that has a bad FCS. The frame is
    then discarded.
  • High numbers of FCS errors from a single station
  • a faulty NIC
  • a faulty software drivers
  • a bad cable connecting
  • FCS errors are associated with many stations
  • a faulty software drivers
  • bad cabling
  • a faulty hub
  • noise in the cable system

FCS and beyond (cont.)
  • A message that does not end on an octet boundary
    is known as an alignment error.
  • bad software drivers
  • Collision
  • A frame with a valid value in the Length field
    but did not match the actual number of octets
    counted in the data field of the received frame
    is known as a range error.
  • The length field value is less than the minimum
    legal unpadded size of the data field.
  • Out of Range, is reported when the value in the
    Length field indicates a data size that is too
    large to be legal.
  • Fluke Networks has coined the term ghost to mean
    energy (noise) detected on the cable that appears
    to be a frame, but is lacking a valid SFD.
  • The frame must be at least 72 octets long,
    including the preamble.
  • Ground loops and other wiring problems are
    usually the cause of ghosting.
  • Most network monitoring tools do not recognize
    the existence of ghosts.
  • The tools rely entirely on what the chipset tells

Ethernet auto-negotiation
  • Auto-Negotiation - This process defines how two
    link partners may automatically negotiate a
    configuration offering the best common
    performance level.
  • If anything interrupts communications and the
    link is lost, the two link partners first attempt
    to link again at the last negotiated speed.
  • If that fails, or if it has been too long since
    the link was lost, the Auto-Negotiation process
    starts over.
  • Example
  • 10BASE-T required each station to transmit a link
    pulse about every 16 milliseconds, whenever the
    station was not engaged in transmitting a
  • Auto-Negotiation adopted this signal and renamed
    it a Normal Link Pulse (NLP).
  • When a series of NLPs are sent in a group for the
    purpose of Auto-Negotiation, the group is called
    a Fast Link Pulse (FLP) burst.

Link establishment and full and half duplex
  • Duplex mismatch
  • one end is forced to full duplex
  • the other is forced to half duplex
  • result in collisions and errors
  • 10-Gigabit Ethernet does not support half duplex
  • The list is priority ranked, with the most
    desirable link configuration at the top.
  • Fiber-optic Ethernet implementations are not
    included in this priority resolution list because
    the interface configuration is fixed.

  • END