Ethernet

• Ethernet Wiring
• Ethernet Encoding
• Ethernet Frames
• Hardware Addressing
• Ethernet Interface Hardware
• Frame Types

Ethernet Wire Types

• Thickwire (10Base5) -- coaxial cable is the shared medium, connected to transceivers (using vampire taps), connected to Network Interface Cards
• Thinwire (10Base2) -- coaxial cable is the shared medium, plugged into BNC connectors connected to Network Interface Cards
• CAT-5 (10BaseT) -- twisted pair connects Network Interface Card to hubs, which are the actual shared medium.

Ethernet Encoding

• 10Mb/s Ethernet is encoded using Manchester Encoding
• "1" bit is encoded by a rising edge:
  • if the voltage was low, in the middle of the bit period, raise the voltage
  • if the voltage was high, lower the voltage at the beginning of the bit period, then raise it in the middle of the bit period.
  "0" bit is encoded by a falling edge:
  • if the voltage was low, raise the voltage at the beginning of the bit period, then lower it in the middle of the bit period.
  • if the voltage was high, lower the voltage in the middle of the bit period.

  

• there is at least one transition per bit, allowing the receiver to keep its clock synchronized
• 1010101010... (64 bits) bit pattern is sent before every frame: preamble, has a transition in the middle of each bit slot

Ethernet Frames

• preamble allows receiver clocks to synchronize
• destination comes first: very little buffering/intelligence needed to discard a frame that is not for me
• source address is generally ignored
• ethertype identifies next higher protocol (if it is greater than 1500. Otherwise, it identifies the payload length, and LLC is the next higher protocol)
• minimum data length is required to insure that everyone sees the same collisions

Ethernet Addresses

• each ethernet address is 6 bytes long
• each ethernet NIC (Network Interface Card) carries a unique ethernet address in hardware
• blocks of 2²⁴ ethernet addresses are sold to companies for 4-digit (dollar) figures.
• it is up to the company to assign the low-order 24 bits as they please
• because each address is globally unique, computers plugged into the same network are guaranteed to have distinct addresses

Broadcast and Multicast

• each NIC generally looks at the first 6 bytes of the header to determine whether to read or ignore the rest of the packet
• NICs are also configured to accept the address ff:ff:ff:ff:ff:ff -- the broadcast address
• many NICs can also be configured to recognize other (arbitrary) addresses -- this allows for multicasting, sending data to a restricted set of hosts without bothering the others
• many NICs can also be configured into promiscuous mode, where they forward all packets to the host

Network Analyzers, tcpdump

• analyzers can make visible (blinking lights :-) or report any number of events or statistics:
  • collisions
  • frames per second
  • average frame size
  • network utilization
  • broadcast frames
• analyzers can also be full computers running software to classify each packet
• tcpdump on Unix will print all the headers of all received packets
• most LANs are not very secure!

Network Interface Cards

• a Network Interface Card (NIC) connects the computer (CPU and memory) to the network
• a NIC has an analog side which connects to the LAN and a digital side connected to the computer
• a NIC will:
  • recognize frames
  • check the destination address
  • if the frame is for us, store it in memory (DMA) and interrupt the computer
  • also check the CRC
  • DMA outgoing frames, insert CRC after sending

Ethernet Type, LLC/SNAP

• ethertype is 0x0800 for IP packets, 0x0806 for ARP packets
• if ethertype is 1500 (hex 5DC) or less, it encodes the payload length, and other protocols (LLC/Logical Link Control) must be used to determine next higher layer
• LLC starts with bytes AA, AA, 03
• followed by 3 bytes of organizational unique ID identifying the issuer of the type field -- all zeros for Ethernet types
• followed by the type field itself