Chapter 5:

Ethernet

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 1
Chapter 5
5.1 Ethernet Protocol
5.2 Address Resolution Protocol
5.3 LAN Switches

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 2
 5.1 Ethernet Protocol

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 3
 5.1 Ethernet Protocol - LLC and MAC Sublayers
Ethernet –
• Most widely used LAN technology
• Operates in the data link layer and the physical layer
• Family of networking technologies that are defined in the IEEE 802.2
and 802.3 standards
• Supports data bandwidths of 10, 100, 1000, 10,000, 40,000, and
100,000 Mbps (100 Gbps)

Ethernet standards –
• Define Layer 2 protocols and Layer 1 technologies
• Two separate sub layers of the data link layer to operate - Logical
link control (LLC) and the MAC sublayers

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 4
Ethernet Protocol - LLC and MAC Sublayers

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 5
 Ethernet Protocol - LLC and MAC Sublayers
LLC
• Handles communication between upper and lower layers
• Takes the network protocol data and adds control
information to help deliver the packet to the destination
MAC
• Constitutes the lower sublayer of the data link layer
• Implemented by hardware, typically in the computer NIC
• Two primary responsibilities:
• Data encapsulation
• Media access control

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 6
 Ethernet Protocol - MAC Sublayers

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 7
 Ethernet Protocol - MAC Sublayers
(A) Data encapsulation
• Frame assembly before transmission and frame disassembly upon
reception of a frame
• MAC layer adds a header and trailer to the network layer PDU

Provides three primary functions:

• Frame delimiting – identifies a group of bits that make up a frame,
synchronization between the transmitting and receiving nodes
• Addressing – each Ethernet header added in the frame contains the
physical address (MAC address) that enables a frame to be delivered
to a destination node
• Error detection - each Ethernet frame contains a trailer with a cyclic
redundancy check (CRC) of the frame contents

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 8
Ethernet Operation
Media Access Control
(B) Carrier Sense Multiple Access (CSMA) process
• Used to first detect if the media is carrying a signal
• If no carrier signal is detected, the device transmits its data
• If two devices transmit at the same time - data collision

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 9
 Ethernet Operation
Media Access Control
(CSMA/CD vs CSMA/CA)

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 10
Ethernet Operation
Media Access Control
The two commonly used methods are:
CSMA/Collision Detection
• The device monitors the media for the presence of a data signal
• If a data signal is idle, indicating that the media is free, the device
transmits the data
• If signals are then detected “busy” that show another device was
transmitting at the same time, all devices stop sending and try again
later
• While Ethernet networks are designed with CSMA/CD technology, with
today’s intermediate devices, collisions do not occur and the
processes utilized by CSMA/CD are really unnecessary
• Wireless connections in a LAN environment still have to take collisions
into account

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 11
 12

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 12
Ethernet Operation
Media Access Control
The two commonly used methods are:
CSMA/Collision Avoidance (CSMA/CA) media access
method
• Device examines the media for the presence of data signal - if the
media is free, the device sends a notification across the media of its
intent to use it
• The device then sends the data.
• Used by 802.11 wireless networking technologies

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 13
▪ https://www.youtube.com/watch?v=xLsejOjV9aY

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 14
 Ethernet Frame Attributes
Ethernet Encapsulation
▪ Early versions of Ethernet were relatively slow at 10 Mbps
▪ Now operate at 10 Gigabits per second and faster
▪ Ethernet frame structure adds headers and trailers around the Layer 3
PDU to encapsulate the message being sent

Ethernet II is the
Ethernet frame
format used in
TCP/IP networks.

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 15
Ethernet Frame Attributes
Introduction to the Ethernet Frame

Start Frame Length/Type 802.2 Header

Preamble Delimiter Field & Data
Notify Fields Defines the exact Increase this
destination Used for length of the frame field to
to get synchronization frame's data field/ at least 64
ready for between the describes which bytes
the new sending and protocol is
frame. receiving implemented
devices
Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 16
 Ethernet Frame Attributes
Ethernet Frame Size
▪ Ethernet II and IEEE 802.3 standards define the
minimum frame size as 64 bytes and the maximum as
1518 bytes
▪ Less than 64 bytes in length is considered a "collision
fragment" or "runt frame”
▪ If size of a transmitted frame is less than the minimum or
greater than the maximum, the receiving device drops the
frame
▪ At the physical layer, different versions of Ethernet vary in
their method for detecting and placing data on the media

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 17
Ethernet Frame Attributes
Introduction to the Ethernet Frame

Frame Check Sequence Field

Used to detect errors in a frame with cyclic redundancy check
(4 bytes), if calculations match at source and receiver, no error
occurred.
Cyclic Redundancy Check (CRC)

http://www.youtube.com/watch?v=Mfby7k6_Z9k&list=PLzVDJS
ginQzJAujbMbrOfdhoHbihz3yrl&index=1

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 18
MAC Address

▪ A media access control address (MAC address) is a

unique identifier assigned to a network interface
controller (NIC) for use as a network address in
communications within a network segment
▪ are primarily assigned by device manufacturers,
▪ Also called
BIA (burned-in address)
Physical address
Hardware address
Ethernet address
NIC address
19
NIC serial number
Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 19
Ethernet Operation
MAC Address: Ethernet Identity
• Layer 2 Ethernet MAC address is a 48-bit binary value expressed as 12
hexadecimal digits
▪ IEEE requires a vendor to follow two simple rules:
• Must use that vendor's assigned OUI as the first 3 bytes
• All MAC addresses with the same OUI must be assigned a unique
value in the last 3 bytes

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 20
Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 21
Ethernet MAC
MAC Address Representations

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 22
 23

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 23
Ethernet MAC
MAC Addresses and Hexadecimal

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 24
 https://aruljohn.com/mac.pl

25

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 25
Ethernet MAC
Unicast MAC Address

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 26
Ethernet MAC
Broadcast MAC Address

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 27
Ethernet MAC
Multicast MAC Address

Multicast MAC address is a Range of IPV4 multicast addresses

special value that begins with is 224.0.0.0 to 239.255.255.255
01-00-5E in hexadecimal
Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 28
Ethernet Operation
Frame Processing
▪ MAC addresses assigned to workstations,
servers, printers, switches, and routers
▪ Example MACs: 00-05-9A-3C-78-00,
00:05:9A:3C:78:00, or 0005.9A3C.7800.
▪ Forwarded message to an Ethernet network,
attaches header information to the packet,
contains the source and destination MAC
address
▪ Each NIC views information to see if the
destination MAC address in the frame matches
the device’s physical MAC address stored in
RAM
▪ No match, the device discards the frame
▪ Matches the destination MAC of the frame, the
NIC passes the frame up the OSI layers, where
the decapsulation process takes place
Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 29
MAC and IP
MAC and IP
MAC address
▪ This address does not change
▪ Similar to the name of a person
▪ Known as physical address because physically assigned to the host NIC

IP address
▪ Similar to the address of a person
▪ Based on where the host is actually located
▪ Known as a logical address because assigned logically
▪ Assigned to each host by a network administrator

Both the physical MAC and logical IP addresses are required for a
computer to communicate just like both the name and address of a person
are required to send a letter
Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 30
Ethernet MAC
End-to-End Connectivity, MAC, and IP

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 31
Point to Point , End to End addresses
▪ MAC address is point to point
- Responsible to send data from NIC to NIC
- MAC address in the frame changes from point to point

▪ IP address is end to end

- Responsible to send data from network to network from
Original Sender to Final Destination
- IP address in the frame NEVER changes

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 32
 192.168.1.1 10.1.1.1 10.1.1.2 172.16.1.1
00:00:00:12:22:44 00:00:00:12:ab:ef 00:00:00:12:bc:22 00:00:00:11:bb:cc

00:00:00:12:32:33
00:00:00:11:aa:cc

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 33
Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 34
Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 35
 5.2 Address Resolution

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 36
ARP
Introduction to ARP
ARP Purpose
▪ Sending node needs a way to find the MAC address of the
destination for a given Ethernet link

The ARP protocol provides two basic functions:

▪ Resolving IPv4 addresses to MAC addresses
▪ Maintaining a table of mappings

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 37
ARP
Introduction to ARP

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 38
ARP
ARP Functions/Operation
ARP Table –
▪ Used to find the data link layer address that is mapped to the
destination IPv4 address
▪ As a node receives frames from the media, it records the source IP
and MAC address as a mapping in the ARP table

ARP request –
▪ Layer 2 broadcast to all devices on the Ethernet LAN
▪ The node that matches the IP address in the broadcast will reply
▪ If no device responds to the ARP request, the packet is dropped
because a frame cannot be created

Static map entries can be entered in an ARP table, but

this is rarely done
Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 39
ARP
ARP Functions/Operation

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 40
ARP
ARP Functions/Operation

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 41
Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 42
Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 43
Wireshark capture

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 44
ARP
ARP Role in Remote Communication
▪ If the destination IPv4 host
is on the local network,
the frame will use the MAC
address of this device as
the destination MAC
address

▪ If the destination IPv4 host

is not on the local
network, the source uses
the ARP process to
determine a MAC address
for the router interface
serving as the gateway

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 45
Example

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 46
 5.3 LAN Switches

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 47
Switching
Switch Port Fundamentals
Layer 2 LAN switch

▪ Connects end devices to a central intermediate device on

most Ethernet networks

▪ Performs switching and filtering based only on the MAC

address

▪ Builds a MAC address table that it uses to make forwarding

decisions

▪ Depends on routers to pass data between IP subnetworks

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 48
Switching
How does switch stores MAC address of
each device (Switch MAC Address Table)

1. The switch receives a broadcast frame from PC 1 on Port 1.

2. The switch enters the source MAC address and the switch port that
received the frame into the address table.

3. Because the destination address is a broadcast, the switch floods the

frame to all ports, except the port on which it received the frame.

4. The destination device replies to the broadcast with a unicast frame

addressed to PC 1.

Continued…
Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 49
Switching
Switch MAC Address Table

5. The switch enters the source MAC address of PC 2 and the port number
of the switch port that received the frame into the address table. The
destination address of the frame and its associated port is found in the
MAC address table.

6. The switch can now forward frames between source and destination
devices without flooding, because it has entries in the address table that
identify the associated ports.

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 50
Switching
Duplex Settings

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 51
Switching
Auto-MDIX

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 52
Switch Forwarding Activity

Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 53
Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 54
Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 55
Presentation_ID © 2008 Cisco Systems, Inc. All rights reserved. Cisco Confidential 56