http://www.hackforums.net/ Tue, 08 Jul 2008 17:07:42 -0400 MyBB http://www.hackforums.net/showthread.php?tid=22698 Tue, 08 Jul 2008 17:01:47 -0400 http://www.hackforums.net/showthread.php?tid=22698
I joined a forum (http://www.fedormma.com/forum/index.php) approximately 4 months ago that, in the following months, was overrun by advertisement bots. I contacted both administrator's multiple times to let them know about the problem, but they never replied nor did anything. I was aware that both of them were administrators on another forum I frequented so I contacted them there. One of the admins told me that he would fix it as soon as possible (2-3 months ago). I have sent him a couple Pm's since then and he has continued to ignore me. I know he doesn't plan on getting rid of the bots because it is a forum he has never really concerned himself with.

All I am requesting is the password to the admin's account (http://www.fedormma.com/forum/member.php?u=1) so that I can get rid of the bots and get some activity back. I have tried a few of the things I looked up online to get the password but none of them worked. I'm sure it is possible and that I could learn to do it in time, but to be completely honest I have no interest in hacking anyone in the future.

go easy on me guys, i tried to explain my situation as best as i could so that you would take me seriously. i just figured i would give it a try. if none of you want to help i understand. thanks for your time. if you have any questions let me know.]]>
I joined a forum (http://www.fedormma.com/forum/index.php) approximately 4 months ago that, in the following months, was overrun by advertisement bots. I contacted both administrator's multiple times to let them know about the problem, but they never replied nor did anything. I was aware that both of them were administrators on another forum I frequented so I contacted them there. One of the admins told me that he would fix it as soon as possible (2-3 months ago). I have sent him a couple Pm's since then and he has continued to ignore me. I know he doesn't plan on getting rid of the bots because it is a forum he has never really concerned himself with.

All I am requesting is the password to the admin's account (http://www.fedormma.com/forum/member.php?u=1) so that I can get rid of the bots and get some activity back. I have tried a few of the things I looked up online to get the password but none of them worked. I'm sure it is possible and that I could learn to do it in time, but to be completely honest I have no interest in hacking anyone in the future.

go easy on me guys, i tried to explain my situation as best as i could so that you would take me seriously. i just figured i would give it a try. if none of you want to help i understand. thanks for your time. if you have any questions let me know.]]> http://www.hackforums.net/showthread.php?tid=22697 Tue, 08 Jul 2008 16:52:12 -0400 http://www.hackforums.net/showthread.php?tid=22697 My name is Mark. this is what you may call me, or Azkule is Fine.
I have always been interested in the "underground" of computers and technology, sure.. computers are fun, you can play games, watch all your tv and everything, BUT that has never been enough. i previously have had little to no time to dedicate to educating myself further in computers, untill recently when i finished a semester of school and am on a break. i have not taken any computer courses but i have grown up with computers most of my life, they have been great tools and i hope they can be an even greater one with more reasearch and dedication. i juggle a steady full/part time job and an active skateboarding social "network", with school ending i have opened a slot for my computing needs.

i live in a small town in Canada, you could ask anyone and they would say the same thing about our town. "The only thing to do in our town when your not working is, drinking, drugs, skateboarding and computer oriented activities"

i plan to be a semi active "contributer", posting my suggestions, ideas and critisism whilst attempting to educate myself further on the subject of hacking and soft/hardware exploitation.

so dont expect me to be online 24/7, you may only see me once or twice a week, or not at all but when im on it will probobaly be for a worth while post or during a random block of free time.]]> My name is Mark. this is what you may call me, or Azkule is Fine.
I have always been interested in the "underground" of computers and technology, sure.. computers are fun, you can play games, watch all your tv and everything, BUT that has never been enough. i previously have had little to no time to dedicate to educating myself further in computers, untill recently when i finished a semester of school and am on a break. i have not taken any computer courses but i have grown up with computers most of my life, they have been great tools and i hope they can be an even greater one with more reasearch and dedication. i juggle a steady full/part time job and an active skateboarding social "network", with school ending i have opened a slot for my computing needs.

i live in a small town in Canada, you could ask anyone and they would say the same thing about our town. "The only thing to do in our town when your not working is, drinking, drugs, skateboarding and computer oriented activities"

i plan to be a semi active "contributer", posting my suggestions, ideas and critisism whilst attempting to educate myself further on the subject of hacking and soft/hardware exploitation.

so dont expect me to be online 24/7, you may only see me once or twice a week, or not at all but when im on it will probobaly be for a worth while post or during a random block of free time.]]> http://www.hackforums.net/showthread.php?tid=22696 Tue, 08 Jul 2008 16:49:02 -0400 http://www.hackforums.net/showthread.php?tid=22696
Ethernet is now the dominant LAN technology in the world. Ethernet is not one technology but a family of LAN technologies and may be best understood by using the OSI reference model. All LANs must deal with the basic issue of how individual stations (nodes) are named, and Ethernet is no exception. Ethernet specifications support different media, bandwidths, and other Layer 1 and 2 variations. However, the basic frame format and addressing scheme is the same for all varieties of Ethernet.

For multiple stations to access physical media and other networking devices, various media access control strategies have been invented. Understanding how network devices gain access to the network media is essential for understanding and troubleshooting the operation of the entire network.

Students completing this module should be able to:

* Describe the basics of Ethernet technology.
* Explain naming rules of Ethernet technology.
* Define how Ethernet and the OSI model interact.
* Describe the Ethernet framing process and frame structure.
* List Ethernet frame field names and purposes.
* Identify the characteristics of CSMA/CD.
* Describe the key aspects of Ethernet timing, interframe spacing and backoff time after a collision.
* Define Ethernet errors and collisions.
* Explain the concept of auto-negotiation in relation to speed and duplex.

Introduction to Ethernet
Most of the traffic on the Internet originates and ends with Ethernet connections. From its beginning in the 1970s, Ethernet has evolved to meet the increasing demand for high speed LANs. When a new media was produced, such as optical fiber, Ethernet adapted to take advantage of the superior bandwidth and low error rate that fiber offers. Now, the same protocol that transported data at 3 Mbps in 1973 is carrying data at 10 Gbps.

The success of Ethernet is due to the following factors:

* Simplicity and ease of maintenance
* Ability to incorporate new technologies
* Reliability
* Low cost of installation and upgrade

With the introduction of Gigabit Ethernet, what started as a LAN technology now extends out to distances that make Ethernet a metropolitan-area network (MAN) and wide-area network (WAN) standard.

The original idea for Ethernet grew out of the problem of allowing two or more hosts to use the same medium and prevent the signals from interfering with each other. This problem of multiple user access to a shared medium was studied in the early 1970s at the University of Hawaii. A system called Alohanet was developed to allow various stations on the Hawaiian Islands structured access to the shared radio frequency band in the atmosphere. This work later formed the basis for the Ethernet access method known as CSMA/CD.

The first LAN in the world was the original version of Ethernet. Robert Metcalfe and his coworkers at Xerox designed it more than thirty years ago. The first Ethernet standard was published in 1980 by a consortium of Digital Equipment Company, Intel, and Xerox (DIX). Metcalfe wanted Ethernet to be a shared standard from which everyone could benefit, so it was released as an open standard. The first products developed using the Ethernet standard were sold during the early 1980s. Ethernet transmitted at up to 10 Mbps over thick coaxial cable up to a distance of two kilometers. This type of coaxial cable was referred to as thicknet and was about the width of a small finger.

In 1985, the Institute of Electrical and Electronics Engineers (IEEE) standards committee for Local and Metropolitan Networks published standards for LANs. These standards start with the number 802. The standard for Ethernet is 802.3. The IEEE wanted to make sure that its standards were compatible with the International Standards Organization (ISO)/OSI model. To do this, the IEEE 802.3 standard had to address the needs of Layer 1 and the lower portion of Layer 2 of the OSI model. As a result, some small modifications to the original Ethernet standard were made in 802.3.

The differences between the two standards were so minor that any Ethernet network interface card (NIC) can transmit and receive both Ethernet and 802.3 frames. Essentially, Ethernet and IEEE 802.3 are the same standards.

The 10-Mbps bandwidth of Ethernet was more than enough for the slow personal computers (PCs) of the 1980s. By the early 1990s PCs became much faster, file sizes increased, and data flow bottlenecks were occurring. Most were caused by the low availability of bandwidth. In 1995, IEEE announced a standard for a 100-Mbps Ethernet. This was followed by standards for gigabit per second (Gbps, 1 billion bits per second) Ethernet in 1998 and 1999.

All the standards are essentially compatible with the original Ethernet standard. An Ethernet frame could leave an older coax 10-Mbps NIC in a PC, be placed onto a 10-Gbps Ethernet fiber link, and end up at a 100-Mbps NIC. As long as the packet stays on Ethernet networks it is not changed. For this reason Ethernet is considered very scalable. The bandwidth of the network could be increased many times without changing the underlying Ethernet technology.

The original Ethernet standard has been amended a number of times in order to manage new transmission media and higher transmission rates. These amendments provide standards for the emerging technologies and maintain compatibility between Ethernet variations.

IEEE Ethernet naming rules
Ethernet is not one networking technology, but a family of networking technologies that includes Legacy, Fast Ethernet, and Gigabit Ethernet. Ethernet speeds can be 10, 100, 1000, or 10,000 Mbps. The basic frame format and the IEEE sublayers of OSI Layers 1 and 2 remain consistent across all forms of Ethernet.

When Ethernet needs to be expanded to add a new medium or capability, the IEEE issues a new supplement to the 802.3 standard. The new supplements are given a one or two letter designation such as 802.3u. An abbreviated description (called an identifier) is also assigned to the supplement.

The abbreviated description consists of:

* A number indicating the number of Mbps transmitted.
* The word base, indicating that baseband signaling is used.
* One or more letters of the alphabet indicating the type of medium used (F= fiber optical cable, T = copper unshielded twisted pair).

Ethernet relies on baseband signaling, which uses the entire bandwidth of the transmission medium. The data signal is transmitted directly over the transmission medium. In broadband signaling, not used by Ethernet, the data signal is never placed directly on the transmission medium. An analog signal (carrier signal) is modulated by the data signal and the modulated carrier signal is transmitted. Radio broadcasts and cable TV use broadband signaling.

The IEEE cannot force manufacturers of networking equipment to fully comply with all the particulars of any standard. The IEEE hopes to achieve the following:

* Supply the engineering information necessary to build devices that comply with Ethernet standards.
* Promote innovation by manufacturers.

Ethernet and the OSI model
Ethernet operates in two areas of the OSI model, the lower half of the data link layer, known as the MAC sublayer and the physical layer.

To move data between one Ethernet station and another, the data often passes through a repeater. All other stations in the same collision domain see traffic that passes through a repeater. A collision domain is then a shared resource. Problems originating in one part of the collision domain will usually impact the entire collision domain.

A repeater is responsible for forwarding all traffic to all other ports. Traffic received by a repeater is never sent out the originating port. Any signal detected by a repeater will be forwarded. If the signal is degraded through attenuation or noise, the repeater will attempt to reconstruct and regenerate the signal.

Standards guarantee minimum bandwidth and operability by specifying the maximum number of stations per segment, maximum segment length, maximum number of repeaters between stations, etc. Stations separated by repeaters are within the same collision domain. Stations separated by bridges or routers are in different collision domains.

Figure maps a variety of Ethernet technologies to the lower half of OSI Layer 2 and all of Layer 1. Ethernet at Layer 1 involves interfacing with media, signals, bit streams that travel on the media, components that put signals on media, and various topologies. Ethernet Layer 1 performs a key role in the communication that takes place between devices, but each of its functions has limitations. Layer 2 addresses these limitations.

Data link sublayers contribute significantly to technology compatibility and computer communication. The MAC sublayer is concerned with the physical components that will be used to communicate the information. The Logical Link Control (LLC) sublayer remains relatively independent of the physical equipment that will be used for the communication process.

Figure maps a variety of Ethernet technologies to the lower half of OSI Layer 2 and all of Layer 1. While there are other varieties of Ethernet, the ones shown are the most widely used.

Naming
To allow for local delivery of frames on the Ethernet, there must be an addressing system, a way of uniquely identifying computers and interfaces. Ethernet uses MAC addresses that are 48 bits in length and expressed as twelve hexadecimal digits. The first six hexadecimal digits, which are administered by the IEEE, identify the manufacturer or vendor. This portion of the MAC address is known as the Organizational Unique Identifier (OUI). The remaining six hexadecimal digits represent the interface serial number, or another value administered by the specific equipment manufacturer. MAC addresses are sometimes referred to as burned-in addresses (BIA) because they are burned into read-only memory (ROM) and are copied into random-access memory (RAM) when the NIC initializes.

At the data link layer MAC headers and trailers are added to upper layer data. The header and trailer contain control information intended for the data link layer in the destination system. Data from upper layer entities is encapsulated in the data link layer header and trailer.

The NIC uses the MAC address to assess whether the message should be passed onto the upper layers of the OSI model. The NIC makes this assessment without using CPU processing time, enabling better communication times on an Ethernet network.

On an Ethernet network, when one device sends data it can open a communication pathway to the other device by using the destination MAC address. The source device attaches a header with the MAC address of the intended destination and sends data onto the network. As this data propagates along the network media the NIC in each device on the network checks to see if the MAC address matches the physical destination address carried by the data frame. If there is no match, the NIC discards the data frame. When the data reaches the destination node, the NIC makes a copy and passes the frame up the OSI layers. On an Ethernet network, all nodes must examine the MAC header even if the communicating nodes are side by side.

All devices that are connected to the Ethernet LAN have MAC addressed interfaces including workstations, printers, routers, and switches.

Layer 2 framing
Encoded bit streams (data) on physical media represent a tremendous technological accomplishment, but they, alone, are not enough to make communication happen. Framing helps obtain essential information that could not, otherwise, be obtained with coded bit streams alone. Examples of such information are:

* Which computers are communicating with one another
* When communication between individual computers begins and when it terminates
* Provides a method for detection of errors that occurred during the communication
* Whose turn it is to "talk" in a computer "conversation"

Framing is the Layer 2 encapsulation process. A frame is the Layer 2 protocol data unit.

A voltage vs. time graph could be used to visualize bits. However, when dealing with larger units of data, addressing and control information, a voltage vs. time graph could become large and confusing. Another type of diagram that could be used is the frame format diagram, which is based on voltage versus time graphs. Frame format diagrams are read from left to right, just like an oscilloscope graph. The frame format diagram shows different groupings of bits (fields) that perform other functions.

There are many different types of frames described by various standards. A single generic frame has sections called fields, and each field is composed of bytes. The names of the fields are as follows:

* Start frame field
* Address field
* Length / type field
* Data field
* Frame check sequence field

When computers are connected to a physical medium, there must be a way they can grab the attention of other computers to broadcast the message, "Here comes a frame!" Various technologies have different ways of doing this process, but all frames, regardless of technology, have a beginning signaling sequence of bytes.

All frames contain naming information, such as the name of the source node (MAC address) and the name of the destination node (MAC address).

Most frames have some specialized fields. In some technologies, a length field specifies the exact length of a frame in bytes. Some frames have a type field, which specifies the Layer 3 protocol making the sending request.

The reason for sending frames is to get upper layer data, ultimately the user application data, from the source to the destination. The data package has two parts, the user application data and the encapsulated bytes to be sent to the destination computer. Padding bytes may be added so frames have a minimum length for timing purposes. Logical link control (LLC) bytes are also included with the data field in the IEEE standard frames. The LLC sub-layer takes the network protocol data, an IP packet, and adds control information to help deliver that IP packet to the destination node. Layer 2 communicates with the upper-level layers through LLC.

All frames and the bits, bytes, and fields contained within them, are susceptible to errors from a variety of sources. The Frame Check Sequence (FCS) field contains a number that is calculated by the source node based on the data in the frame. This FCS is then added to the end of the frame that is being sent. When the destination node receives the frame the FCS number is recalculated and compared with the FCS number included in the frame. If the two numbers are different, an error is assumed, the frame is discarded, and the source is asked to retransmit.

There are three primary ways to calculate the Frame Check Sequence number:

* Cyclic Redundancy Check (CRC) – performs calculations on the data.
* Two-dimensional parity – adds an 8th bit that makes an 8 bit sequence have an odd or even number of binary 1s.
* Internet checksum – adds the values of all of the data bits to arrive at a sum.

The node that transmits data must get the attention of other devices, in order to start a frame, and to end the frame. The length field implies the end, and the frame is considered ended after the FCS. Sometimes there is a formal byte sequence referred to as an end-frame delimiter.

Ethernet frame structure
At the data link layer the frame structure is nearly identical for all speeds of Ethernet from 10 Mbps to 10,000 Mbps. However, at the physical layer almost all versions of Ethernet are substantially different from one another with each speed having a distinct set of architecture design rules.

In the version of Ethernet that was developed by DIX prior to the adoption of the IEEE 802.3 version of Ethernet, the Preamble and Start Frame Delimiter (SFD) were combined into a single field, though the binary pattern was identical. The field labeled Length/Type was only listed as Length in the early IEEE versions and only as Type in the DIX version. These two uses of the field were officially combined in a later IEEE version, as both uses of the field were common throughout industry.

The Ethernet II Type field is incorporated into the current 802.3 frame definition. The receiving node must determine which higher-layer protocol is present in an incoming frame by examining the Length/Type field. If the two-octet value is equal to or greater than 0x600 (hexadecimal), then the frame is interpreted according to the Ethernet II type code indicated.

Ethernet frame fields
Some of the fields permitted or required in an 802.3 Ethernet Frame are:

* Preamble
* Start Frame Delimiter
* Destination Address
* Source Address
* Length/Type
* Data and Pad
* FCS
* Extension

The Preamble is an alternating pattern of ones and zeroes used for timing synchronization in the asynchronous 10 Mbps and slower implementations of Ethernet. Faster versions of Ethernet are synchronous, and this timing information is redundant but retained for compatibility.

A Start Frame Delimiter consists of a one-octet field that marks the end of the timing information, and contains the bit sequence 10101011.

The Destination Address field contains the MAC destination address. The destination address can be unicast, multicast (group), or broadcast (all nodes).

The Source Address field contains the MAC source address. The source address is generally the unicast address of the transmitting Ethernet node. There are, however, an increasing number of virtual protocols in use that use and sometimes share a specific source MAC address to identify the virtual entity.

The Length/Type field supports two different uses. If the value is less than 1536 decimal, 0x600 (hexadecimal), then the value indicates length. The length interpretation is used where the LLC Layer provides the protocol identification. The type value specifies the upper-layer protocol to receive the data after Ethernet processing is completed. The length indicates the number of bytes of data that follows this field. If the value is equal to or greater than 1536 decimal (0600 hexadecimal), the value indicates that the type and contents of the Data field are decoded per the protocol indicated.

The Data and Pad field may be of any length that does not cause the frame to exceed the maximum frame size. The maximum transmission unit (MTU) for Ethernet is 1500 octets, so the data should not exceed that size. The content of this field is unspecified. An unspecified pad is inserted immediately after the user data when there is not enough user data for the frame to meet the minimum frame length. Ethernet requires that the frame be not less than 46 octets or more than 1518 octets.

A FCS contains a four byte CRC value that is created by the sending device and is recalculated by the receiving device to check for damaged frames. Since the corruption of a single bit anywhere from the beginning of the Destination Address through the end of the FCS field will cause the checksum to be different, the coverage of the FCS includes itself. It is not possible to distinguish between corruption of the FCS itself and corruption of any preceding field used in the calculation.

Media Access Control (MAC)
MAC refers to protocols that determine which computer on a shared-medium environment, or collision domain, is allowed to transmit the data. MAC, with LLC, comprises the IEEE version of the OSI Layer 2. MAC and LLC are sublayers of Layer 2. There are two broad categories of Media Access Control, deterministic (taking turns) and non-deterministic (first come, first served).

Examples of deterministic protocols include Token Ring and FDDI. In a Token Ring network, individual hosts are arranged in a ring and a special data token travels around the ring to each host in sequence. When a host wants to transmit, it seizes the token, transmits the data for a limited time, and then forwards the token to the next host in the ring. Token Ring is a collisionless environment as only one host is able to transmit at any given time.

Non-deterministic MAC protocols use a first-come, first-served approach. CSMA/CD is a simple system. The NIC listens for an absence of a signal on the media and starts transmitting. If two nodes transmit at the same time a collision occurs and none of the nodes are able to transmit.

Three common Layer 2 technologies are Token Ring, FDDI, and Ethernet. All three specify Layer 2 issues, LLC, naming, framing, and MAC, as well as Layer 1 signaling components and media issues. The specific technologies for each are as follows:

* Ethernet – logical bus topology (information flow is on a linear bus) and physical star or extended star (wired as a star)
* Token Ring – logical ring topology (in other words, information flow is controlled in a ring) and a physical star topology (in other words, it is wired as a star)
* FDDI – logical ring topology (information flow is controlled in a ring) and physical dual-ring topology (wired as a dual-ring)

MAC rules and collision detection/backoff
Ethernet is a shared-media broadcast technology. The access method CSMA/CD used in Ethernet performs three functions:

* Transmitting and receiving data packets
* Decoding data packets and checking them for valid addresses before passing them to the upper layers of the OSI model
* Detecting errors within data packets or on the network

In the CSMA/CD access method, networking devices with data to transmit work in a listen-before-transmit mode. This means when a node wants to send data, it must first check to see whether the networking media is busy. If the node determines the network is busy, the node will wait a random amount of time before retrying. If the node determines the networking media is not busy, the node will begin transmitting and listening. The node listens to ensure no other stations are transmitting at the same time. After completing data transmission the device will return to listening mode.

Networking devices detect a collision has occurred when the amplitude of the signal on the networking media increases. When a collision occurs, each node that is transmitting will continue to transmit for a short time to ensure that all devices see the collision. Once all the devices have detected the collision a backoff algorithm is invoked and transmission is stopped. The nodes stop transmitting for a random period of time, which is different for each device. When the delay period expires, all devices on the network can attempt to gain access to the networking media. When data transmission resumes on the network, the devices that were involved in the collision do not have priority to transmit data.

Ethernet timing


The basic rules and specifications for proper operation of Ethernet are not particularly complicated, though some of the faster physical layer implementations are becoming so. Despite the basic simplicity, when a problem occurs in Ethernet it is often quite difficult to isolate the source. Because of the common bus architecture of Ethernet, also described as a distributed single point of failure, the scope of the problem usually encompasses all devices within the domain. In situations where repeaters are used, this can include devices up to four segments away.

Any station on an Ethernet network wishing to transmit a message first “listens” to ensure that no other station is currently transmitting. If the cable is quiet, the station will begin transmitting immediately. The electrical signal takes time to travel down the cable (delay), and each subsequent repeater introduces a small amount of latency in forwarding the frame from one port to the next. Because of the delay and latency, it is possible for more than one station to begin transmitting at or near the same time. This results in a collision.

If the attached station is operating in full duplex then the station may send and receive simultaneously and collisions should not occur. Full-duplex operation also changes the timing considerations and eliminates the concept of slot time. Full-duplex operation allows for larger network architecture designs since the timing restriction for collision detection is removed.

In half duplex, assuming that a collision does not occur, the sending station will transmit 64 bits of timing synchronization information that is known as the preamble. The sending station will then transmit the following information:

* Destination and source MAC addressing information
* Certain other header information
* The actual data payload
* Checksum (FCS) used to ensure that the message was not corrupted along the way

Stations receiving the frame recalculate the FCS to determine if the incoming message is valid and then pass valid messages to the next higher layer in the protocol stack.

10 Mbps and slower versions of Ethernet are asynchronous. Asynchronous means that each receiving station will use the eight octets of timing information to synchronize the receive circuit to the incoming data, and then discard it. 100 Mbps and higher speed implementations of Ethernet are synchronous. Synchronous means the timing information is not required, however for compatibility reasons the Preamble and SFD are present.

For all speeds of Ethernet transmission at or below 1000 Mbps, the standard describes how a transmission may be no smaller than the slot time. Slot time for 10 and 100-Mbps Ethernet is 512 bit-times, or 64 octets. Slot time for 1000-Mbps Ethernet is 4096 bit-times, or 512 octets. Slot time is calculated assuming maximum cable lengths on the largest legal network architecture. All hardware propagation delay times are at the legal maximum and the 32-bit jam signal is used when collisions are detected.

The actual calculated slot time is just longer than the theoretical amount of time required to travel between the furthest points of the collision domain, collide with another transmission at the last possible instant, and then have the collision fragments return to the sending station and be detected. For the system to work the first station must learn about the collision before it finishes sending the smallest legal frame size. To allow 1000-Mbps Ethernet to operate in half duplex the extension field was added when sending small frames purely to keep the transmitter busy long enough for a collision fragment to return. This field is present only on 1000-Mbps, half-duplex links and allows minimum-sized frames to be long enough to meet slot time requirements. Extension bits are discarded by the receiving station.

On 10-Mbps Ethernet one bit at the MAC layer requires 100 nanoseconds (ns) to transmit. At 100 Mbps that same bit requires 10 ns to transmit and at 1000 Mbps only takes 1 ns. As a rough estimate, 20.3 cm (8 in) per nanosecond is often used for calculating propagation delay down a UTP cable. For 100 meters of UTP, this means that it takes just under 5 bit-times for a 10BASE-T signal to travel the length the cable.

For CSMA/CD Ethernet to operate, the sending station must become aware of a collision before it has completed transmission of a minimum-sized frame. At 100 Mbps the system timing is barely able to accommodate 100 meter cables. At 1000 Mbps special adjustments are required as nearly an entire minimum-sized frame would be transmitted before the first bit reached the end of the first 100 meters of UTP cable. For this reason half duplex is not permitted in 10-Gigabit Ethernet.

Interframe spacing and backoff
The minimum spacing between two non-colliding frames is also called the interframe spacing. This is measured from the last bit of the FCS field of the first frame to the first bit of the preamble of the second frame.

After a frame has been sent, all stations on a 10-Mbps Ethernet are required to wait a minimum of 96 bit-times (9.6 microseconds) before any station may legally transmit the next frame. On faster versions of Ethernet the spacing remains the same, 96 bit-times, but the time required for that interval grows correspondingly shorter. This interval is referred to as the spacing gap. The gap is intended to allow slow stations time to process the previous frame and prepare for the next frame.

A repeater is expected to regenerate the full 64 bits of timing information, which is the preamble and SFD, at the start of any frame. This is despite the potential loss of some of the beginning preamble bits because of slow synchronization. Because of this forced reintroduction of timing bits, some minor reduction of the interframe gap is not only possible but expected. Some Ethernet chipsets are sensitive to a shortening of the interframe spacing, and will begin failing to see frames as the gap is reduced. With the increase in processing power at the desktop, it would be very easy for a personal computer to saturate an Ethernet segment with traffic and to begin transmitting again before the interframe spacing delay time is satisfied.

After a collision occurs and all stations allow the cable to become idle (each waits the full interframe spacing), then the stations that collided must wait an additional and potentially progressively longer period of time before attempting to retransmit the collided frame. The waiting period is intentionally designed to be random so that two stations do not delay for the same amount of time before retransmitting, which would result in more collisions. This is accomplished in part by expanding the interval from which the random retransmission time is selected on each retransmission attempt. The waiting period is measured in increments of the parameter slot time.

If the MAC layer is unable to send the frame after sixteen attempts, it gives up and generates an error to the network layer. Such an occurrence is fairly rare and would happen only under extremely heavy network loads, or when a physical problem exists on the network.

Error handling
The most common error condition on an Ethernet is the collision. Collisions are the mechanism for resolving contention for network access. A few collisions provide a smooth, simple, low overhead way for network nodes to arbitrate contention for the network resource. When network contention becomes too great, collisions can become a significant impediment to useful network operation.

Collisions result in network bandwidth loss that is equal to the initial transmission and the collision jam signal. This is consumption delay and affects all network nodes possibly causing significant reduction in network throughput.

The considerable majority of collisions occur very early in the frame, often before the SFD. Collisions occurring before the SFD are usually not reported to the higher layers, as if the collision did not occur. As soon as a collision is detected, the sending stations transmit a 32-bit “jam” signal that will enforce the collision. This is done so that any data being transmitted is thoroughly corrupted and all stations have a chance to detect the collision.

In Figure two stations listen to ensure that the cable is idle, then transmit. Station 1 was able to transmit a significant percentage of the frame before the signal even reached the last cable segment. Station 2 had not received the first bit of the transmission prior to beginning its own transmission and was only able to send several bits before the NIC sensed the collision. Station 2 immediately truncated the current transmission, substituted the 32-bit jam signal and ceased all transmissions. During the collision and jam event that Station 2 was experiencing, the collision fragments were working their way back through the repeated collision domain toward Station 1. Station 2 completed transmission of the 32-bit jam signal and became silent before the collision propagated back to Station 1 which was still unaware of the collision and continued to transmit. When the collision fragments finally reached Station 1, it also truncated the current transmission and substituted a 32-bit jam signal in place of the remainder of the frame it was transmitting. Upon sending the 32-bit jam signal Station 1 ceased all transmissions.

A jam signal may be composed of any binary data so long as it does not form a proper checksum for the portion of the frame already transmitted. The most commonly observed data pattern for a jam signal is simply a repeating one, zero, one, zero pattern, the same as Preamble. When viewed by a protocol analyzer this pattern appears as either a repeating hexadecimal 5 or A sequence. The corrupted, partially transmitted messages are often referred to as collision fragments or runts. Normal collisions are less than 64 octets in length and therefore fail both the minimum length test and the FCS checksum test.

Types of collisions
Collisions typically take place when two or more Ethernet stations transmit simultaneously within a collision domain. A single collision is a collision that was detected while trying to transmit a frame, but on the next attempt the frame was transmitted successfully. Multiple collisions indicate that the same frame collided repeatedly before being successfully transmitted. The results of collisions, collision fragments, are partial or corrupted frames that are less than 64 octets and have an invalid FCS. Three types of collisions are:

* Local
* Remote
* Late

To create a local collision on coax cable (10BASE2 and 10BASE5), the signal travels down the cable until it encounters a signal from the other station. The waveforms then overlap, canceling some parts of the signal out and reinforcing or doubling other parts. The doubling of the signal pushes the voltage level of the signal beyond the allowed maximum. This over-voltage condition is then sensed by all of the stations on the local cable segment as a collision.

In the beginning the waveform in Figure represents normal Manchester encoded data. A few cycles into the sample the amplitude of the wave doubles. That is the beginning of the collision, where the two waveforms are overlapping. Just prior to the end of the sample the amplitude returns to normal. This happens when the first station to detect the collision quits transmitting, and the jam signal from the second colliding station is still observed.

On UTP cable, such as 10BASE-T, 100BASE-TX and 1000BASE-T, a collision is detected on the local segment only when a station detects a signal on the RX pair at the same time it is sending on the TX pair. Since the two signals are on different pairs there is no characteristic change in the signal. Collisions are only recognized on UTP when the station is operating in half duplex. The only functional difference between half and full duplex operation in this regard is whether or not the transmit and receive pairs are permitted to be used simultaneously. If the station is not engaged in transmitting it cannot detect a local collision. Conversely, a cable fault such as excessive crosstalk can cause a station to perceive its own transmission as a local collision.

The characteristics of a remote collision are a frame that is less than the minimum length, has an invalid FCS checksum, but does not exhibit the local collision symptom of over-voltage or simultaneous RX/TX activity. This sort of collision usually results from collisions occurring on the far side of a repeated connection. A repeater will not forward an over-voltage state, and cannot cause a station to have both the TX and RX pairs active at the same time. The station would have to be transmitting to have both pairs active, and that would constitute a local collision. On UTP networks this is the most common sort of collision observed.

There is no possibility remaining for a normal or legal collision after the first 64 octets of data has been transmitted by the sending stations. Collisions occurring after the first 64 octets are called “late collisions". The most significant difference between late collisions and collisions occurring before the first 64 octets is that the Ethernet NIC will retransmit a normally collided frame automatically, but will not automatically retransmit a frame that was collided late. As far as the NIC is concerned everything went out fine, and the upper layers of the protocol stack must determine that the frame was lost. Other than retransmission, a station detecting a late collision handles it in exactly the same way as a normal collision.

Ethernet errors
Knowledge of typical errors is invaluable for understanding both the operation and troubleshooting of Ethernet networks.

The following are the sources of Ethernet error:

* Collision or runt – Simultaneous transmission occurring before slot time has elapsed
* Late collision – Simultaneous transmission occurring after slot time has elapsed
* Jabber, long frame and range errors – Excessively or illegally long transmission
* Short frame, collision fragment or runt – Illegally short transmission
* FCS error – Corrupted transmission
* Alignment error – Insufficient or excessive number of bits transmitted
* Range error – Actual and reported number of octets in frame do not match
* Ghost or jabber – Unusually long Preamble or Jam event

While local and remote collisions are considered to be a normal part of Ethernet operation, late collisions are considered to be an error. The presence of errors on a network always suggests that further investigation is warranted. The severity of the problem indicates the troubleshooting urgency related to the detected errors. A handful of errors detected over many minutes or over hours would be a low priority. Thousands detected over a few minutes suggest that urgent attention is warranted.

Jabber is defined in several places in the 802.3 standard as being a transmission of at least 20,000 to 50,000 bit times in duration. However, most diagnostic tools report jabber whenever a detected transmission exceeds the maximum legal frame size, which is considerably smaller than 20,000 to 50,000 bit times. Most references to jabber are more properly called long frames.

A long frame is one that is longer than the maximum legal size, and takes into consideration whether or not the frame was tagged. It does not consider whether or not the frame had a valid FCS checksum. This error usually means that jabber was detected on the network.

A short frame is a frame smaller than the minimum legal size of 64 octets, with a good frame check sequence. Some protocol analyzers and network monitors call these frames “runts". In general the presence of short frames is not a guarantee that the network is failing.

The term runt is generally an imprecise slang term that means something less than a legal frame size. It may refer to short frames with a valid FCS checksum although it usually refers to collision fragments.

FCS and beyond
A received frame that has a bad Frame Check Sequence, also referred to as a checksum or CRC error, differs from the original transmission by at least one bit. In an FCS error frame the header information is probably correct, but the checksum calculated by the receiving station does not match the checksum appended to the end of the frame by the sending station. The frame is then discarded.

High numbers of FCS errors from a single station usually indicates a faulty NIC and/or faulty or corrupted software drivers, or a bad cable connecting that station to the network. If FCS errors are associated with many stations, they are generally traceable to bad cabling, a faulty version of the NIC driver, a faulty hub port, or induced noise in the cable system.

A message that does not end on an octet boundary is known as an alignment error. Instead of the correct number of binary bits forming complete octet groupings, there are additional bits left over (less than eight). Such a frame is truncated to the nearest octet boundary, and if the FCS checksum fails, then an alignment error is reported. This is often caused by bad software drivers, or a collision, and is frequently accompanied by a failure of the FCS checksum.

A frame with a valid value in the Length field but did not match the actual number of octets counted in the data field of the received frame is known as a range error. This error also appears when the length field value is less than the minimum legal unpadded size of the data field. A similar error, Out of Range, is reported when the value in the Length field indicates a data size that is too large to be legal.

Fluke Networks has coined the term ghost to mean energy (noise) detected on the cable that appears to be a frame, but is lacking a valid SFD. To qualify as a ghost, the frame must be at least 72 octets long, including the preamble. Otherwise, it is classified as a remote collision. Because of the peculiar nature of ghosts, it is important to note that test results are largely dependent upon where on the segment the measurement is made.

Ground loops and other wiring problems are usually the cause of ghosting. Most network monitoring tools do not recognize the existence of ghosts for the same reason that they do not recognize preamble collisions. The tools rely entirely on what the chipset tells them. Software-only protocol analyzers, many hardware-based protocol analyzers, hand held diagnostic tools, as well as most remote monitoring (RMON) probes do not report these events.

Ethernet auto-negotiation
As Ethernet grew from 10 to 100 and 1000 Mbps, one requirement was to make each technology interoperable, even to the point that 10, 100, and 1000 interfaces could be directly connected. A process called Auto-Negotiation of speeds at half or full duplex was developed. Specifically, at the time that Fast Ethernet was introduced, the standard included a method of automatically configuring a given interface to match the speed and capabilities of the link partner. This process defines how two link partners may automatically negotiate a configuration offering the best common performance level. It has the additional advantage of only involving the lowest part of the physical layer.

10BASE-T required each station to transmit a link pulse about every 16 milliseconds, whenever the station was not engaged in transmitting a message. Auto-Negotiation adopted this signal and renamed it a Normal Link Pulse (NLP). When a series of NLPs are sent in a group for the purpose of Auto-Negotiation, the group is called a Fast Link Pulse (FLP) burst. Each FLP burst is sent at the same timing interval as an NLP, and is intended to allow older 10BASE-T devices to operate normally in the event they should receive an FLP burst.

Auto-Negotiation is accomplished by transmitting a burst of 10BASE-T Link Pulses from each of the two link partners. The burst communicates the capabilities of the transmitting station to its link partner. After both stations have interpreted what the other partner is offering, both switch to the highest performance common configuration and establish a link at that speed. If anything interrupts communications and the link is lost, the two link partners first attempt to link again at the last negotiated speed. If that fails, or if it has been too long since the link was lost, the Auto-Negotiation process starts over. The link may be lost due to external influences, such as a cable fault, or due to one of the partners issuing a reset.

Link establishment and full and half duplex
Link partners are allowed to skip offering configurations of which they are capable. This allows the network administrator to force ports to a selected speed and duplex setting, without disabling Auto-Negotiation.

Auto-Negotiation is optional for most Ethernet implementations. Gigabit Ethernet requires its implementation, though the user may disable it. Auto-Negotiation was originally defined for UTP implementations of Ethernet and has been extended to work with other fiber optic implementations.

When an Auto-Negotiating station first attempts to link it is supposed to enable 100BASE-TX to attempt to immediately establish a link. If 100BASE-TX signaling is present, and the station supports 100BASE-TX, it will attempt to establish a link without negotiating. If either signaling produces a link or FLP bursts are received, the station will proceed with that technology. If a link partner does not offer an FLP burst, but instead offers NLPs, then that device is automatically assumed to be a 10BASE-T station. During this initial interval of testing for other technologies, the transmit path is sending FLP bursts. The standard does not permit parallel detection of any other technologies.

If a link is established through parallel detection, it is required to be half duplex. There are only two methods of achieving a full-duplex link. One method is through a completed cycle of Auto-Negotiation, and the other is to administratively force both link partners to full duplex. If one link partner is forced to full duplex, but the other partner attempts to Auto-Negotiate, then there is certain to be a duplex mismatch. This will result in collisions and errors on that link. Additionally if one end is forced to full duplex the other must also be forced. The exception to this is 10-Gigabit Ethernet, which does not support half duplex.

Many vendors implement hardware in such a way that it cycles through the various possible states. It transmits FLP bursts to Auto-Negotiate for a while, then it configures for Fast Ethernet, attempts to link for a while, and then just listens. Some vendors do not offer any transmitted attempt to link until the interface first hears an FLP burst or some other signaling scheme.

There are two duplex modes, half and full. For shared media, the half-duplex mode is mandatory. All coaxial implementations are half duplex in nature and cannot operate in full duplex. UTP and fiber implementations may be operated in half duplex. 10-Gbps implementations are specified for full duplex only.

In half duplex only one station may transmit at a time. For the coaxial implementations a second station transmitting will cause the signals to overlap and become corrupted. Since UTP and fiber generally transmit on separate pairs the signals have no opportunity to overlap and become corrupted. Ethernet has established arbitration rules for resolving conflicts arising from instances when more than one station attempts to transmit at the same time. Both stations in a point-to-point full-duplex link are permitted to transmit at any time, regardless of whether the other station is transmitting.

Auto-Negotiation avoids most situations where one station in a point-to-point link is transmitting under half-duplex rules and the other under full-duplex rules.

In the event that link partners are capable of sharing more than one common technology, refer to the list in Figure . This list is used to determine which technology should be chosen from the offered configurations.

Fiber-optic Ethernet implementations are not included in this priority resolution list because the interface electronics and optics do not permit easy reconfiguration between implementations. It is assumed that the interface configuration is fixed. If the two interfaces are able to Auto-Negotiate then they are already using the same Ethernet implementation. However, there remain a number of configuration choices such as the duplex setting, or which station will act as the Master for clocking purposes, that must be determined.

Summary
An understanding of the following key points should have been achieved:

* The basics of Ethernet technology
* The naming rules of Ethernet technology
* How Ethernet and the OSI model interact
* Ethernet framing process and frame structure
* Ethernet frame field names and purposes
* The characteristics and function of CSMA/CD
* Ethernet timing
* Interframe spacing
* The backoff algorithm and time after a collision
* Ethernet errors and collisions
* Auto-negotiation in relation to speed and duplex]]>
Ethernet is now the dominant LAN technology in the world. Ethernet is not one technology but a family of LAN technologies and may be best understood by using the OSI reference model. All LANs must deal with the basic issue of how individual stations (nodes) are named, and Ethernet is no exception. Ethernet specifications support different media, bandwidths, and other Layer 1 and 2 variations. However, the basic frame format and addressing scheme is the same for all varieties of Ethernet.

For multiple stations to access physical media and other networking devices, various media access control strategies have been invented. Understanding how network devices gain access to the network media is essential for understanding and troubleshooting the operation of the entire network.

Students completing this module should be able to:

* Describe the basics of Ethernet technology.
* Explain naming rules of Ethernet technology.
* Define how Ethernet and the OSI model interact.
* Describe the Ethernet framing process and frame structure.
* List Ethernet frame field names and purposes.
* Identify the characteristics of CSMA/CD.
* Describe the key aspects of Ethernet timing, interframe spacing and backoff time after a collision.
* Define Ethernet errors and collisions.
* Explain the concept of auto-negotiation in relation to speed and duplex.

Introduction to Ethernet
Most of the traffic on the Internet originates and ends with Ethernet connections. From its beginning in the 1970s, Ethernet has evolved to meet the increasing demand for high speed LANs. When a new media was produced, such as optical fiber, Ethernet adapted to take advantage of the superior bandwidth and low error rate that fiber offers. Now, the same protocol that transported data at 3 Mbps in 1973 is carrying data at 10 Gbps.

The success of Ethernet is due to the following factors:

* Simplicity and ease of maintenance
* Ability to incorporate new technologies
* Reliability
* Low cost of installation and upgrade

With the introduction of Gigabit Ethernet, what started as a LAN technology now extends out to distances that make Ethernet a metropolitan-area network (MAN) and wide-area network (WAN) standard.

The original idea for Ethernet grew out of the problem of allowing two or more hosts to use the same medium and prevent the signals from interfering with each other. This problem of multiple user access to a shared medium was studied in the early 1970s at the University of Hawaii. A system called Alohanet was developed to allow various stations on the Hawaiian Islands structured access to the shared radio frequency band in the atmosphere. This work later formed the basis for the Ethernet access method known as CSMA/CD.

The first LAN in the world was the original version of Ethernet. Robert Metcalfe and his coworkers at Xerox designed it more than thirty years ago. The first Ethernet standard was published in 1980 by a consortium of Digital Equipment Company, Intel, and Xerox (DIX). Metcalfe wanted Ethernet to be a shared standard from which everyone could benefit, so it was released as an open standard. The first products developed using the Ethernet standard were sold during the early 1980s. Ethernet transmitted at up to 10 Mbps over thick coaxial cable up to a distance of two kilometers. This type of coaxial cable was referred to as thicknet and was about the width of a small finger.

In 1985, the Institute of Electrical and Electronics Engineers (IEEE) standards committee for Local and Metropolitan Networks published standards for LANs. These standards start with the number 802. The standard for Ethernet is 802.3. The IEEE wanted to make sure that its standards were compatible with the International Standards Organization (ISO)/OSI model. To do this, the IEEE 802.3 standard had to address the needs of Layer 1 and the lower portion of Layer 2 of the OSI model. As a result, some small modifications to the original Ethernet standard were made in 802.3.

The differences between the two standards were so minor that any Ethernet network interface card (NIC) can transmit and receive both Ethernet and 802.3 frames. Essentially, Ethernet and IEEE 802.3 are the same standards.

The 10-Mbps bandwidth of Ethernet was more than enough for the slow personal computers (PCs) of the 1980s. By the early 1990s PCs became much faster, file sizes increased, and data flow bottlenecks were occurring. Most were caused by the low availability of bandwidth. In 1995, IEEE announced a standard for a 100-Mbps Ethernet. This was followed by standards for gigabit per second (Gbps, 1 billion bits per second) Ethernet in 1998 and 1999.

All the standards are essentially compatible with the original Ethernet standard. An Ethernet frame could leave an older coax 10-Mbps NIC in a PC, be placed onto a 10-Gbps Ethernet fiber link, and end up at a 100-Mbps NIC. As long as the packet stays on Ethernet networks it is not changed. For this reason Ethernet is considered very scalable. The bandwidth of the network could be increased many times without changing the underlying Ethernet technology.

The original Ethernet standard has been amended a number of times in order to manage new transmission media and higher transmission rates. These amendments provide standards for the emerging technologies and maintain compatibility between Ethernet variations.

IEEE Ethernet naming rules
Ethernet is not one networking technology, but a family of networking technologies that includes Legacy, Fast Ethernet, and Gigabit Ethernet. Ethernet speeds can be 10, 100, 1000, or 10,000 Mbps. The basic frame format and the IEEE sublayers of OSI Layers 1 and 2 remain consistent across all forms of Ethernet.

When Ethernet needs to be expanded to add a new medium or capability, the IEEE issues a new supplement to the 802.3 standard. The new supplements are given a one or two letter designation such as 802.3u. An abbreviated description (called an identifier) is also assigned to the supplement.

The abbreviated description consists of:

* A number indicating the number of Mbps transmitted.
* The word base, indicating that baseband signaling is used.
* One or more letters of the alphabet indicating the type of medium used (F= fiber optical cable, T = copper unshielded twisted pair).

Ethernet relies on baseband signaling, which uses the entire bandwidth of the transmission medium. The data signal is transmitted directly over the transmission medium. In broadband signaling, not used by Ethernet, the data signal is never placed directly on the transmission medium. An analog signal (carrier signal) is modulated by the data signal and the modulated carrier signal is transmitted. Radio broadcasts and cable TV use broadband signaling.

The IEEE cannot force manufacturers of networking equipment to fully comply with all the particulars of any standard. The IEEE hopes to achieve the following:

* Supply the engineering information necessary to build devices that comply with Ethernet standards.
* Promote innovation by manufacturers.

Ethernet and the OSI model
Ethernet operates in two areas of the OSI model, the lower half of the data link layer, known as the MAC sublayer and the physical layer.

To move data between one Ethernet station and another, the data often passes through a repeater. All other stations in the same collision domain see traffic that passes through a repeater. A collision domain is then a shared resource. Problems originating in one part of the collision domain will usually impact the entire collision domain.

A repeater is responsible for forwarding all traffic to all other ports. Traffic received by a repeater is never sent out the originating port. Any signal detected by a repeater will be forwarded. If the signal is degraded through attenuation or noise, the repeater will attempt to reconstruct and regenerate the signal.

Standards guarantee minimum bandwidth and operability by specifying the maximum number of stations per segment, maximum segment length, maximum number of repeaters between stations, etc. Stations separated by repeaters are within the same collision domain. Stations separated by bridges or routers are in different collision domains.

Figure maps a variety of Ethernet technologies to the lower half of OSI Layer 2 and all of Layer 1. Ethernet at Layer 1 involves interfacing with media, signals, bit streams that travel on the media, components that put signals on media, and various topologies. Ethernet Layer 1 performs a key role in the communication that takes place between devices, but each of its functions has limitations. Layer 2 addresses these limitations.

Data link sublayers contribute significantly to technology compatibility and computer communication. The MAC sublayer is concerned with the physical components that will be used to communicate the information. The Logical Link Control (LLC) sublayer remains relatively independent of the physical equipment that will be used for the communication process.

Figure maps a variety of Ethernet technologies to the lower half of OSI Layer 2 and all of Layer 1. While there are other varieties of Ethernet, the ones shown are the most widely used.

Naming
To allow for local delivery of frames on the Ethernet, there must be an addressing system, a way of uniquely identifying computers and interfaces. Ethernet uses MAC addresses that are 48 bits in length and expressed as twelve hexadecimal digits. The first six hexadecimal digits, which are administered by the IEEE, identify the manufacturer or vendor. This portion of the MAC address is known as the Organizational Unique Identifier (OUI). The remaining six hexadecimal digits represent the interface serial number, or another value administered by the specific equipment manufacturer. MAC addresses are sometimes referred to as burned-in addresses (BIA) because they are burned into read-only memory (ROM) and are copied into random-access memory (RAM) when the NIC initializes.

At the data link layer MAC headers and trailers are added to upper layer data. The header and trailer contain control information intended for the data link layer in the destination system. Data from upper layer entities is encapsulated in the data link layer header and trailer.

The NIC uses the MAC address to assess whether the message should be passed onto the upper layers of the OSI model. The NIC makes this assessment without using CPU processing time, enabling better communication times on an Ethernet network.

On an Ethernet network, when one device sends data it can open a communication pathway to the other device by using the destination MAC address. The source device attaches a header with the MAC address of the intended destination and sends data onto the network. As this data propagates along the network media the NIC in each device on the network checks to see if the MAC address matches the physical destination address carried by the data frame. If there is no match, the NIC discards the data frame. When the data reaches the destination node, the NIC makes a copy and passes the frame up the OSI layers. On an Ethernet network, all nodes must examine the MAC header even if the communicating nodes are side by side.

All devices that are connected to the Ethernet LAN have MAC addressed interfaces including workstations, printers, routers, and switches.

Layer 2 framing
Encoded bit streams (data) on physical media represent a tremendous technological accomplishment, but they, alone, are not enough to make communication happen. Framing helps obtain essential information that could not, otherwise, be obtained with coded bit streams alone. Examples of such information are:

* Which computers are communicating with one another
* When communication between individual computers begins and when it terminates
* Provides a method for detection of errors that occurred during the communication
* Whose turn it is to "talk" in a computer "conversation"

Framing is the Layer 2 encapsulation process. A frame is the Layer 2 protocol data unit.

A voltage vs. time graph could be used to visualize bits. However, when dealing with larger units of data, addressing and control information, a voltage vs. time graph could become large and confusing. Another type of diagram that could be used is the frame format diagram, which is based on voltage versus time graphs. Frame format diagrams are read from left to right, just like an oscilloscope graph. The frame format diagram shows different groupings of bits (fields) that perform other functions.

There are many different types of frames described by various standards. A single generic frame has sections called fields, and each field is composed of bytes. The names of the fields are as follows:

* Start frame field
* Address field
* Length / type field
* Data field
* Frame check sequence field

When computers are connected to a physical medium, there must be a way they can grab the attention of other computers to broadcast the message, "Here comes a frame!" Various technologies have different ways of doing this process, but all frames, regardless of technology, have a beginning signaling sequence of bytes.

All frames contain naming information, such as the name of the source node (MAC address) and the name of the destination node (MAC address).

Most frames have some specialized fields. In some technologies, a length field specifies the exact length of a frame in bytes. Some frames have a type field, which specifies the Layer 3 protocol making the sending request.

The reason for sending frames is to get upper layer data, ultimately the user application data, from the source to the destination. The data package has two parts, the user application data and the encapsulated bytes to be sent to the destination computer. Padding bytes may be added so frames have a minimum length for timing purposes. Logical link control (LLC) bytes are also included with the data field in the IEEE standard frames. The LLC sub-layer takes the network protocol data, an IP packet, and adds control information to help deliver that IP packet to the destination node. Layer 2 communicates with the upper-level layers through LLC.

All frames and the bits, bytes, and fields contained within them, are susceptible to errors from a variety of sources. The Frame Check Sequence (FCS) field contains a number that is calculated by the source node based on the data in the frame. This FCS is then added to the end of the frame that is being sent. When the destination node receives the frame the FCS number is recalculated and compared with the FCS number included in the frame. If the two numbers are different, an error is assumed, the frame is discarded, and the source is asked to retransmit.

There are three primary ways to calculate the Frame Check Sequence number:

* Cyclic Redundancy Check (CRC) – performs calculations on the data.
* Two-dimensional parity – adds an 8th bit that makes an 8 bit sequence have an odd or even number of binary 1s.
* Internet checksum – adds the values of all of the data bits to arrive at a sum.

The node that transmits data must get the attention of other devices, in order to start a frame, and to end the frame. The length field implies the end, and the frame is considered ended after the FCS. Sometimes there is a formal byte sequence referred to as an end-frame delimiter.

Ethernet frame structure
At the data link layer the frame structure is nearly identical for all speeds of Ethernet from 10 Mbps to 10,000 Mbps. However, at the physical layer almost all versions of Ethernet are substantially different from one another with each speed having a distinct set of architecture design rules.

In the version of Ethernet that was developed by DIX prior to the adoption of the IEEE 802.3 version of Ethernet, the Preamble and Start Frame Delimiter (SFD) were combined into a single field, though the binary pattern was identical. The field labeled Length/Type was only listed as Length in the early IEEE versions and only as Type in the DIX version. These two uses of the field were officially combined in a later IEEE version, as both uses of the field were common throughout industry.

The Ethernet II Type field is incorporated into the current 802.3 frame definition. The receiving node must determine which higher-layer protocol is present in an incoming frame by examining the Length/Type field. If the two-octet value is equal to or greater than 0x600 (hexadecimal), then the frame is interpreted according to the Ethernet II type code indicated.

Ethernet frame fields
Some of the fields permitted or required in an 802.3 Ethernet Frame are:

* Preamble
* Start Frame Delimiter
* Destination Address
* Source Address
* Length/Type
* Data and Pad
* FCS
* Extension

The Preamble is an alternating pattern of ones and zeroes used for timing synchronization in the asynchronous 10 Mbps and slower implementations of Ethernet. Faster versions of Ethernet are synchronous, and this timing information is redundant but retained for compatibility.

A Start Frame Delimiter consists of a one-octet field that marks the end of the timing information, and contains the bit sequence 10101011.

The Destination Address field contains the MAC destination address. The destination address can be unicast, multicast (group), or broadcast (all nodes).

The Source Address field contains the MAC source address. The source address is generally the unicast address of the transmitting Ethernet node. There are, however, an increasing number of virtual protocols in use that use and sometimes share a specific source MAC address to identify the virtual entity.

The Length/Type field supports two different uses. If the value is less than 1536 decimal, 0x600 (hexadecimal), then the value indicates length. The length interpretation is used where the LLC Layer provides the protocol identification. The type value specifies the upper-layer protocol to receive the data after Ethernet processing is completed. The length indicates the number of bytes of data that follows this field. If the value is equal to or greater than 1536 decimal (0600 hexadecimal), the value indicates that the type and contents of the Data field are decoded per the protocol indicated.

The Data and Pad field may be of any length that does not cause the frame to exceed the maximum frame size. The maximum transmission unit (MTU) for Ethernet is 1500 octets, so the data should not exceed that size. The content of this field is unspecified. An unspecified pad is inserted immediately after the user data when there is not enough user data for the frame to meet the minimum frame length. Ethernet requires that the frame be not less than 46 octets or more than 1518 octets.

A FCS contains a four byte CRC value that is created by the sending device and is recalculated by the receiving device to check for damaged frames. Since the corruption of a single bit anywhere from the beginning of the Destination Address through the end of the FCS field will cause the checksum to be different, the coverage of the FCS includes itself. It is not possible to distinguish between corruption of the FCS itself and corruption of any preceding field used in the calculation.

Media Access Control (MAC)
MAC refers to protocols that determine which computer on a shared-medium environment, or collision domain, is allowed to transmit the data. MAC, with LLC, comprises the IEEE version of the OSI Layer 2. MAC and LLC are sublayers of Layer 2. There are two broad categories of Media Access Control, deterministic (taking turns) and non-deterministic (first come, first served).

Examples of deterministic protocols include Token Ring and FDDI. In a Token Ring network, individual hosts are arranged in a ring and a special data token travels around the ring to each host in sequence. When a host wants to transmit, it seizes the token, transmits the data for a limited time, and then forwards the token to the next host in the ring. Token Ring is a collisionless environment as only one host is able to transmit at any given time.

Non-deterministic MAC protocols use a first-come, first-served approach. CSMA/CD is a simple system. The NIC listens for an absence of a signal on the media and starts transmitting. If two nodes transmit at the same time a collision occurs and none of the nodes are able to transmit.

Three common Layer 2 technologies are Token Ring, FDDI, and Ethernet. All three specify Layer 2 issues, LLC, naming, framing, and MAC, as well as Layer 1 signaling components and media issues. The specific technologies for each are as follows:

* Ethernet – logical bus topology (information flow is on a linear bus) and physical star or extended star (wired as a star)
* Token Ring – logical ring topology (in other words, information flow is controlled in a ring) and a physical star topology (in other words, it is wired as a star)
* FDDI – logical ring topology (information flow is controlled in a ring) and physical dual-ring topology (wired as a dual-ring)

MAC rules and collision detection/backoff
Ethernet is a shared-media broadcast technology. The access method CSMA/CD used in Ethernet performs three functions:

* Transmitting and receiving data packets
* Decoding data packets and checking them for valid addresses before passing them to the upper layers of the OSI model
* Detecting errors within data packets or on the network

In the CSMA/CD access method, networking devices with data to transmit work in a listen-before-transmit mode. This means when a node wants to send data, it must first check to see whether the networking media is busy. If the node determines the network is busy, the node will wait a random amount of time before retrying. If the node determines the networking media is not busy, the node will begin transmitting and listening. The node listens to ensure no other stations are transmitting at the same time. After completing data transmission the device will return to listening mode.

Networking devices detect a collision has occurred when the amplitude of the signal on the networking media increases. When a collision occurs, each node that is transmitting will continue to transmit for a short time to ensure that all devices see the collision. Once all the devices have detected the collision a backoff algorithm is invoked and transmission is stopped. The nodes stop transmitting for a random period of time, which is different for each device. When the delay period expires, all devices on the network can attempt to gain access to the networking media. When data transmission resumes on the network, the devices that were involved in the collision do not have priority to transmit data.

Ethernet timing


The basic rules and specifications for proper operation of Ethernet are not particularly complicated, though some of the faster physical layer implementations are becoming so. Despite the basic simplicity, when a problem occurs in Ethernet it is often quite difficult to isolate the source. Because of the common bus architecture of Ethernet, also described as a distributed single point of failure, the scope of the problem usually encompasses all devices within the domain. In situations where repeaters are used, this can include devices up to four segments away.

Any station on an Ethernet network wishing to transmit a message first “listens” to ensure that no other station is currently transmitting. If the cable is quiet, the station will begin transmitting immediately. The electrical signal takes time to travel down the cable (delay), and each subsequent repeater introduces a small amount of latency in forwarding the frame from one port to the next. Because of the delay and latency, it is possible for more than one station to begin transmitting at or near the same time. This results in a collision.

If the attached station is operating in full duplex then the station may send and receive simultaneously and collisions should not occur. Full-duplex operation also changes the timing considerations and eliminates the concept of slot time. Full-duplex operation allows for larger network architecture designs since the timing restriction for collision detection is removed.

In half duplex, assuming that a collision does not occur, the sending station will transmit 64 bits of timing synchronization information that is known as the preamble. The sending station will then transmit the following information:

* Destination and source MAC addressing information
* Certain other header information
* The actual data payload
* Checksum (FCS) used to ensure that the message was not corrupted along the way

Stations receiving the frame recalculate the FCS to determine if the incoming message is valid and then pass valid messages to the next higher layer in the protocol stack.

10 Mbps and slower versions of Ethernet are asynchronous. Asynchronous means that each receiving station will use the eight octets of timing information to synchronize the receive circuit to the incoming data, and then discard it. 100 Mbps and higher speed implementations of Ethernet are synchronous. Synchronous means the timing information is not required, however for compatibility reasons the Preamble and SFD are present.

For all speeds of Ethernet transmission at or below 1000 Mbps, the standard describes how a transmission may be no smaller than the slot time. Slot time for 10 and 100-Mbps Ethernet is 512 bit-times, or 64 octets. Slot time for 1000-Mbps Ethernet is 4096 bit-times, or 512 octets. Slot time is calculated assuming maximum cable lengths on the largest legal network architecture. All hardware propagation delay times are at the legal maximum and the 32-bit jam signal is used when collisions are detected.

The actual calculated slot time is just longer than the theoretical amount of time required to travel between the furthest points of the collision domain, collide with another transmission at the last possible instant, and then have the collision fragments return to the sending station and be detected. For the system to work the first station must learn about the collision before it finishes sending the smallest legal frame size. To allow 1000-Mbps Ethernet to operate in half duplex the extension field was added when sending small frames purely to keep the transmitter busy long enough for a collision fragment to return. This field is present only on 1000-Mbps, half-duplex links and allows minimum-sized frames to be long enough to meet slot time requirements. Extension bits are discarded by the receiving station.

On 10-Mbps Ethernet one bit at the MAC layer requires 100 nanoseconds (ns) to transmit. At 100 Mbps that same bit requires 10 ns to transmit and at 1000 Mbps only takes 1 ns. As a rough estimate, 20.3 cm (8 in) per nanosecond is often used for calculating propagation delay down a UTP cable. For 100 meters of UTP, this means that it takes just under 5 bit-times for a 10BASE-T signal to travel the length the cable.

For CSMA/CD Ethernet to operate, the sending station must become aware of a collision before it has completed transmission of a minimum-sized frame. At 100 Mbps the system timing is barely able to accommodate 100 meter cables. At 1000 Mbps special adjustments are required as nearly an entire minimum-sized frame would be transmitted before the first bit reached the end of the first 100 meters of UTP cable. For this reason half duplex is not permitted in 10-Gigabit Ethernet.

Interframe spacing and backoff
The minimum spacing between two non-colliding frames is also called the interframe spacing. This is measured from the last bit of the FCS field of the first frame to the first bit of the preamble of the second frame.

After a frame has been sent, all stations on a 10-Mbps Ethernet are required to wait a minimum of 96 bit-times (9.6 microseconds) before any station may legally transmit the next frame. On faster versions of Ethernet the spacing remains the same, 96 bit-times, but the time required for that interval grows correspondingly shorter. This interval is referred to as the spacing gap. The gap is intended to allow slow stations time to process the previous frame and prepare for the next frame.

A repeater is expected to regenerate the full 64 bits of timing information, which is the preamble and SFD, at the start of any frame. This is despite the potential loss of some of the beginning preamble bits because of slow synchronization. Because of this forced reintroduction of timing bits, some minor reduction of the interframe gap is not only possible but expected. Some Ethernet chipsets are sensitive to a shortening of the interframe spacing, and will begin failing to see frames as the gap is reduced. With the increase in processing power at the desktop, it would be very easy for a personal computer to saturate an Ethernet segment with traffic and to begin transmitting again before the interframe spacing delay time is satisfied.

After a collision occurs and all stations allow the cable to become idle (each waits the full interframe spacing), then the stations that collided must wait an additional and potentially progressively longer period of time before attempting to retransmit the collided frame. The waiting period is intentionally designed to be random so that two stations do not delay for the same amount of time before retransmitting, which would result in more collisions. This is accomplished in part by expanding the interval from which the random retransmission time is selected on each retransmission attempt. The waiting period is measured in increments of the parameter slot time.

If the MAC layer is unable to send the frame after sixteen attempts, it gives up and generates an error to the network layer. Such an occurrence is fairly rare and would happen only under extremely heavy network loads, or when a physical problem exists on the network.

Error handling
The most common error condition on an Ethernet is the collision. Collisions are the mechanism for resolving contention for network access. A few collisions provide a smooth, simple, low overhead way for network nodes to arbitrate contention for the network resource. When network contention becomes too great, collisions can become a significant impediment to useful network operation.

Collisions result in network bandwidth loss that is equal to the initial transmission and the collision jam signal. This is consumption delay and affects all network nodes possibly causing significant reduction in network throughput.

The considerable majority of collisions occur very early in the frame, often before the SFD. Collisions occurring before the SFD are usually not reported to the higher layers, as if the collision did not occur. As soon as a collision is detected, the sending stations transmit a 32-bit “jam” signal that will enforce the collision. This is done so that any data being transmitted is thoroughly corrupted and all stations have a chance to detect the collision.

In Figure two stations listen to ensure that the cable is idle, then transmit. Station 1 was able to transmit a significant percentage of the frame before the signal even reached the last cable segment. Station 2 had not received the first bit of the transmission prior to beginning its own transmission and was only able to send several bits before the NIC sensed the collision. Station 2 immediately truncated the current transmission, substituted the 32-bit jam signal and ceased all transmissions. During the collision and jam event that Station 2 was experiencing, the collision fragments were working their way back through the repeated collision domain toward Station 1. Station 2 completed transmission of the 32-bit jam signal and became silent before the collision propagated back to Station 1 which was still unaware of the collision and continued to transmit. When the collision fragments finally reached Station 1, it also truncated the current transmission and substituted a 32-bit jam signal in place of the remainder of the frame it was transmitting. Upon sending the 32-bit jam signal Station 1 ceased all transmissions.

A jam signal may be composed of any binary data so long as it does not form a proper checksum for the portion of the frame already transmitted. The most commonly observed data pattern for a jam signal is simply a repeating one, zero, one, zero pattern, the same as Preamble. When viewed by a protocol analyzer this pattern appears as either a repeating hexadecimal 5 or A sequence. The corrupted, partially transmitted messages are often referred to as collision fragments or runts. Normal collisions are less than 64 octets in length and therefore fail both the minimum length test and the FCS checksum test.

Types of collisions
Collisions typically take place when two or more Ethernet stations transmit simultaneously within a collision domain. A single collision is a collision that was detected while trying to transmit a frame, but on the next attempt the frame was transmitted successfully. Multiple collisions indicate that the same frame collided repeatedly before being successfully transmitted. The results of collisions, collision fragments, are partial or corrupted frames that are less than 64 octets and have an invalid FCS. Three types of collisions are:

* Local
* Remote
* Late

To create a local collision on coax cable (10BASE2 and 10BASE5), the signal travels down the cable until it encounters a signal from the other station. The waveforms then overlap, canceling some parts of the signal out and reinforcing or doubling other parts. The doubling of the signal pushes the voltage level of the signal beyond the allowed maximum. This over-voltage condition is then sensed by all of the stations on the local cable segment as a collision.

In the beginning the waveform in Figure represents normal Manchester encoded data. A few cycles into the sample the amplitude of the wave doubles. That is the beginning of the collision, where the two waveforms are overlapping. Just prior to the end of the sample the amplitude returns to normal. This happens when the first station to detect the collision quits transmitting, and the jam signal from the second colliding station is still observed.

On UTP cable, such as 10BASE-T, 100BASE-TX and 1000BASE-T, a collision is detected on the local segment only when a station detects a signal on the RX pair at the same time it is sending on the TX pair. Since the two signals are on different pairs there is no characteristic change in the signal. Collisions are only recognized on UTP when the station is operating in half duplex. The only functional difference between half and full duplex operation in this regard is whether or not the transmit and receive pairs are permitted to be used simultaneously. If the station is not engaged in transmitting it cannot detect a local collision. Conversely, a cable fault such as excessive crosstalk can cause a station to perceive its own transmission as a local collision.

The characteristics of a remote collision are a frame that is less than the minimum length, has an invalid FCS checksum, but does not exhibit the local collision symptom of over-voltage or simultaneous RX/TX activity. This sort of collision usually results from collisions occurring on the far side of a repeated connection. A repeater will not forward an over-voltage state, and cannot cause a station to have both the TX and RX pairs active at the same time. The station would have to be transmitting to have both pairs active, and that would constitute a local collision. On UTP networks this is the most common sort of collision observed.

There is no possibility remaining for a normal or legal collision after the first 64 octets of data has been transmitted by the sending stations. Collisions occurring after the first 64 octets are called “late collisions". The most significant difference between late collisions and collisions occurring before the first 64 octets is that the Ethernet NIC will retransmit a normally collided frame automatically, but will not automatically retransmit a frame that was collided late. As far as the NIC is concerned everything went out fine, and the upper layers of the protocol stack must determine that the frame was lost. Other than retransmission, a station detecting a late collision handles it in exactly the same way as a normal collision.

Ethernet errors
Knowledge of typical errors is invaluable for understanding both the operation and troubleshooting of Ethernet networks.

The following are the sources of Ethernet error:

* Collision or runt – Simultaneous transmission occurring before slot time has elapsed
* Late collision – Simultaneous transmission occurring after slot time has elapsed
* Jabber, long frame and range errors – Excessively or illegally long transmission
* Short frame, collision fragment or runt – Illegally short transmission
* FCS error – Corrupted transmission
* Alignment error – Insufficient or excessive number of bits transmitted
* Range error – Actual and reported number of octets in frame do not match
* Ghost or jabber – Unusually long Preamble or Jam event

While local and remote collisions are considered to be a normal part of Ethernet operation, late collisions are considered to be an error. The presence of errors on a network always suggests that further investigation is warranted. The severity of the problem indicates the troubleshooting urgency related to the detected errors. A handful of errors detected over many minutes or over hours would be a low priority. Thousands detected over a few minutes suggest that urgent attention is warranted.

Jabber is defined in several places in the 802.3 standard as being a transmission of at least 20,000 to 50,000 bit times in duration. However, most diagnostic tools report jabber whenever a detected transmission exceeds the maximum legal frame size, which is considerably smaller than 20,000 to 50,000 bit times. Most references to jabber are more properly called long frames.

A long frame is one that is longer than the maximum legal size, and takes into consideration whether or not the frame was tagged. It does not consider whether or not the frame had a valid FCS checksum. This error usually means that jabber was detected on the network.

A short frame is a frame smaller than the minimum legal size of 64 octets, with a good frame check sequence. Some protocol analyzers and network monitors call these frames “runts". In general the presence of short frames is not a guarantee that the network is failing.

The term runt is generally an imprecise slang term that means something less than a legal frame size. It may refer to short frames with a valid FCS checksum although it usually refers to collision fragments.

FCS and beyond
A received frame that has a bad Frame Check Sequence, also referred to as a checksum or CRC error, differs from the original transmission by at least one bit. In an FCS error frame the header information is probably correct, but the checksum calculated by the receiving station does not match the checksum appended to the end of the frame by the sending station. The frame is then discarded.

High numbers of FCS errors from a single station usually indicates a faulty NIC and/or faulty or corrupted software drivers, or a bad cable connecting that station to the network. If FCS errors are associated with many stations, they are generally traceable to bad cabling, a faulty version of the NIC driver, a faulty hub port, or induced noise in the cable system.

A message that does not end on an octet boundary is known as an alignment error. Instead of the correct number of binary bits forming complete octet groupings, there are additional bits left over (less than eight). Such a frame is truncated to the nearest octet boundary, and if the FCS checksum fails, then an alignment error is reported. This is often caused by bad software drivers, or a collision, and is frequently accompanied by a failure of the FCS checksum.

A frame with a valid value in the Length field but did not match the actual number of octets counted in the data field of the received frame is known as a range error. This error also appears when the length field value is less than the minimum legal unpadded size of the data field. A similar error, Out of Range, is reported when the value in the Length field indicates a data size that is too large to be legal.

Fluke Networks has coined the term ghost to mean energy (noise) detected on the cable that appears to be a frame, but is lacking a valid SFD. To qualify as a ghost, the frame must be at least 72 octets long, including the preamble. Otherwise, it is classified as a remote collision. Because of the peculiar nature of ghosts, it is important to note that test results are largely dependent upon where on the segment the measurement is made.

Ground loops and other wiring problems are usually the cause of ghosting. Most network monitoring tools do not recognize the existence of ghosts for the same reason that they do not recognize preamble collisions. The tools rely entirely on what the chipset tells them. Software-only protocol analyzers, many hardware-based protocol analyzers, hand held diagnostic tools, as well as most remote monitoring (RMON) probes do not report these events.

Ethernet auto-negotiation
As Ethernet grew from 10 to 100 and 1000 Mbps, one requirement was to make each technology interoperable, even to the point that 10, 100, and 1000 interfaces could be directly connected. A process called Auto-Negotiation of speeds at half or full duplex was developed. Specifically, at the time that Fast Ethernet was introduced, the standard included a method of automatically configuring a given interface to match the speed and capabilities of the link partner. This process defines how two link partners may automatically negotiate a configuration offering the best common performance level. It has the additional advantage of only involving the lowest part of the physical layer.

10BASE-T required each station to transmit a link pulse about every 16 milliseconds, whenever the station was not engaged in transmitting a message. Auto-Negotiation adopted this signal and renamed it a Normal Link Pulse (NLP). When a series of NLPs are sent in a group for the purpose of Auto-Negotiation, the group is called a Fast Link Pulse (FLP) burst. Each FLP burst is sent at the same timing interval as an NLP, and is intended to allow older 10BASE-T devices to operate normally in the event they should receive an FLP burst.

Auto-Negotiation is accomplished by transmitting a burst of 10BASE-T Link Pulses from each of the two link partners. The burst communicates the capabilities of the transmitting station to its link partner. After both stations have interpreted what the other partner is offering, both switch to the highest performance common configuration and establish a link at that speed. If anything interrupts communications and the link is lost, the two link partners first attempt to link again at the last negotiated speed. If that fails, or if it has been too long since the link was lost, the Auto-Negotiation process starts over. The link may be lost due to external influences, such as a cable fault, or due to one of the partners issuing a reset.

Link establishment and full and half duplex
Link partners are allowed to skip offering configurations of which they are capable. This allows the network administrator to force ports to a selected speed and duplex setting, without disabling Auto-Negotiation.

Auto-Negotiation is optional for most Ethernet implementations. Gigabit Ethernet requires its implementation, though the user may disable it. Auto-Negotiation was originally defined for UTP implementations of Ethernet and has been extended to work with other fiber optic implementations.

When an Auto-Negotiating station first attempts to link it is supposed to enable 100BASE-TX to attempt to immediately establish a link. If 100BASE-TX signaling is present, and the station supports 100BASE-TX, it will attempt to establish a link without negotiating. If either signaling produces a link or FLP bursts are received, the station will proceed with that technology. If a link partner does not offer an FLP burst, but instead offers NLPs, then that device is automatically assumed to be a 10BASE-T station. During this initial interval of testing for other technologies, the transmit path is sending FLP bursts. The standard does not permit parallel detection of any other technologies.

If a link is established through parallel detection, it is required to be half duplex. There are only two methods of achieving a full-duplex link. One method is through a completed cycle of Auto-Negotiation, and the other is to administratively force both link partners to full duplex. If one link partner is forced to full duplex, but the other partner attempts to Auto-Negotiate, then there is certain to be a duplex mismatch. This will result in collisions and errors on that link. Additionally if one end is forced to full duplex the other must also be forced. The exception to this is 10-Gigabit Ethernet, which does not support half duplex.

Many vendors implement hardware in such a way that it cycles through the various possible states. It transmits FLP bursts to Auto-Negotiate for a while, then it configures for Fast Ethernet, attempts to link for a while, and then just listens. Some vendors do not offer any transmitted attempt to link until the interface first hears an FLP burst or some other signaling scheme.

There are two duplex modes, half and full. For shared media, the half-duplex mode is mandatory. All coaxial implementations are half duplex in nature and cannot operate in full duplex. UTP and fiber implementations may be operated in half duplex. 10-Gbps implementations are specified for full duplex only.

In half duplex only one station may transmit at a time. For the coaxial implementations a second station transmitting will cause the signals to overlap and become corrupted. Since UTP and fiber generally transmit on separate pairs the signals have no opportunity to overlap and become corrupted. Ethernet has established arbitration rules for resolving conflicts arising from instances when more than one station attempts to transmit at the same time. Both stations in a point-to-point full-duplex link are permitted to transmit at any time, regardless of whether the other station is transmitting.

Auto-Negotiation avoids most situations where one station in a point-to-point link is transmitting under half-duplex rules and the other under full-duplex rules.

In the event that link partners are capable of sharing more than one common technology, refer to the list in Figure . This list is used to determine which technology should be chosen from the offered configurations.

Fiber-optic Ethernet implementations are not included in this priority resolution list because the interface electronics and optics do not permit easy reconfiguration between implementations. It is assumed that the interface configuration is fixed. If the two interfaces are able to Auto-Negotiate then they are already using the same Ethernet implementation. However, there remain a number of configuration choices such as the duplex setting, or which station will act as the Master for clocking purposes, that must be determined.

Summary
An understanding of the following key points should have been achieved:

* The basics of Ethernet technology
* The naming rules of Ethernet technology
* How Ethernet and the OSI model interact
* Ethernet framing process and frame structure
* Ethernet frame field names and purposes
* The characteristics and function of CSMA/CD
* Ethernet timing
* Interframe spacing
* The backoff algorithm and time after a collision
* Ethernet errors and collisions
* Auto-negotiation in relation to speed and duplex]]> http://www.hackforums.net/showthread.php?tid=22695 Tue, 08 Jul 2008 16:47:37 -0400 http://www.hackforums.net/showthread.php?tid=22695 I think windows vista is a nice OS. I have one Vista and one XP and a bunch of other crap pcs, Windows vista is a good OS for me because it is VERY fast and has a very nice GUI, aslong as the computer your running windows vista is suspost to run windows vista the OS will work wonderfully.


What do you think about Windows Vista ?
( if you talk bad about it you must have used it and please tell us your spects about it... eg, ram )]]> I think windows vista is a nice OS. I have one Vista and one XP and a bunch of other crap pcs, Windows vista is a good OS for me because it is VERY fast and has a very nice GUI, aslong as the computer your running windows vista is suspost to run windows vista the OS will work wonderfully.


What do you think about Windows Vista ?
( if you talk bad about it you must have used it and please tell us your spects about it... eg, ram )]]> http://www.hackforums.net/showthread.php?tid=22694 Tue, 08 Jul 2008 16:40:29 -0400 http://www.hackforums.net/showthread.php?tid=22694
Even though each local-area network is unique, there are many design aspects that are common to all LANs. For example, most LANs follow the same standards and the same components. This module presents information on elements of Ethernet LANs and common LAN devices.

There are several wide-area network (WAN) connections available today. They range from dial-up to broadband access, and differ in bandwidth, cost, and required equipment. This module presents information on the various types of WAN connections.

Students completing this module should be able to:

* Identify characteristics of Ethernet networks.
* Identify straight-through, crossover, and rollover cables.
* Describe the function, advantages, and disadvantages of repeaters, hubs, bridges, switches, and wireless network components.
* Describe the function of peer-to-peer networks.
* Describe the function, advantages, and disadvantages of client-server networks.
* Describe and differentiate between serial, Integrated Services Digital Network (ISDN), digital subscriber line (DSL), and cable modem WAN connections.
* Identify router serial ports, cables, and connectors.
* Identify and describe the placement of equipment used in various WAN configurations.

LAN physical layer
Various symbols are used to represent media types. Token Ring is represented by a circle. Fiber Distributed Data Interface (FDDI) is represented by two concentric circles and the Ethernet symbol is represented by a straight line. Serial connections are represented by a lightning bolt.

Each computer network can be built with many different media types. The function of media is to carry a flow of information through a LAN. Wireless LANs use the atmosphere, or space, as the medium. Other networking media confine network signals to a wire, cable, or fiber. Networking media are considered Layer 1, or physical layer, components of LANs.

Each media has advantages and disadvantages. Some of the advantage or disadvantage comparisons concern:

* Cable length
* Cost
* Ease of installation
* Susceptibility to interference

Coaxial cable, optical fiber, and even free space can carry network signals. However, the principal medium that will be studied is Category 5 unshielded twisted-pair cable (Cat 5 UTP) which includes the Cat 5e family of cables.

Many topologies support LANs, as well as many different physical media. Figure shows a subset of physical layer implementations that can be deployed to support Ethernet.

Ethernet in the campus


Ethernet is the most widely used LAN technology. Ethernet was first implemented by the Digital, Intel, and Xerox group, referred to as DIX. DIX created and implemented the first Ethernet LAN specification, which was used as the basis for the Institute of Electrical and Electronics Engineers (IEEE) 802.3 specification, released in 1980. Later, the IEEE extended 802.3 to three new committees known as 802.3u (Fast Ethernet), 802.3z (Gigabit Ethernet over Fiber), and 802.3ab (Gigabit Ethernet over UTP).

Network requirements might dictate that an upgrade to one of the faster Ethernet topologies be used. Most Ethernet networks support speeds of 10 Mbps and 100 Mbps.

The new generation of multimedia, imaging, and database products, can easily overwhelm a network running at traditional Ethernet speeds of 10 and 100 Mbps. Network administrators may consider providing Gigabit Ethernet from the backbone to the end user. Costs for installing new cabling and adapters can make this prohibitive. Gigabit Ethernet to the desktop is not a standard installation at this time.

In general, Ethernet technologies can be used in a campus network in several different ways:

* An Ethernet speed of 10 Mbps can be used at the user level to provide good performance. Clients or servers that require more bandwidth can use 100-Mbps Ethernet.
* Fast Ethernet is used as the link between user and network devices. It can support the combination of all traffic from each Ethernet segment.
* To enhance client-server performance across the campus network and avoid bottlenecks, Fast Ethernet can be used to connect enterprise servers.
* Fast Ethernet or Gigabit Ethernet, as affordable, should be implemented between backbone devices.

Ethernet media and connector requirements
Before selecting an Ethernet implementation, consider the media and connector requirements for each implementation. Also, consider the level of performance needed by the network.

The cables and connector specifications used to support Ethernet implementations are derived from the Electronic Industries Association and the Telecommunications Industry Association (EIA/TIA) standards body. The categories of cabling defined for Ethernet are derived from the EIA/TIA-568 (SP-2840) Commercial Building Telecommunications Wiring Standards.

Figure compares the cable and connector specifications for the most popular Ethernet implementations. It is important to note the difference in the media used for 10-Mbps Ethernet versus 100-Mbps Ethernet. Networks with a combination of 10- and 100-Mbps traffic use UTP Category 5 to support Fast Ethernet.

Connection media

Figure illustrates the different connection types used by each physical layer implementation. The registered jack (RJ-45) connector and jack are the most common. RJ-45 connectors are discussed in more detail in the next section.

In some cases the type of connector on a network interface card (NIC) does not match the media that it needs to connect to. As shown in Figure , an interface may exist for the 15-pin attachment unit interface (AUI) connector. The AUI connector allows different media to connect when used with the appropriate transceiver. A transceiver is an adapter that converts one type of connection to another. Typically, a transceiver converts an AUI to RJ-45, coax, or fiber optic connector. On 10BASE5 Ethernet, or Thicknet, a short cable is used to connect the AUI with a transceiver on the main cable.

UTP implementation
EIA/TIA specifies an RJ-45 connector for UTP cable. The letters RJ stand for registered jack, and the number 45 refers to a specific wiring sequence. The RJ-45 transparent end connector shows eight colored wires. Four of the wires carry the voltage and are considered “tip” (T1 through T4). The other four wires are grounded and are called “ring” (R1 through R4). Tip and ring are terms that originated in the early days of the telephone. Today, these terms refer to the positive and the negative wire in a pair. The wires in the first pair in a cable or a connector are designated as T1 and R1. The second pair is T2 and R2, and so on.

The RJ-45 connector is the male component, crimped on the end of the cable. When looking at the male connector from the front, the pin locations are numbered 8 on the left down to 1 on the right as seen in Figure .

The jack is the female component in a network device, wall outlet, or patch panel as seen in Figure . Figure shows the punch-down connections at the back of the jack where the Ethernet UTP cable connects.

For electricity to run between the connector and the jack, the order of the wires must follow EIA/TIA-T568-A or T568-B standards, as shown in Figure . Identify the correct EIA/TIA category of cable to use for a connecting device by determining what standard is being used by the jack on the network device. In addition to identifying the correct EIA/TIA category of cable, determine whether to use a straight-through cable or a crossover cable.

If the two RJ-45 connectors of a cable are held side by side in the same orientation, the colored wires will be seen in each. If the order of the colored wires is the same at each end, then the cable is straight-through as seen in Figure .

With crossover, the RJ-45 connectors on both ends show that some of the wires on one side of the cable are crossed to a different pin on the other side of the cable. Figure shows that pins 1 and 2 on one connector connect respectively to pins 3 and 6 on the other.

Figure shows the guidelines for what type of cable to use when interconnecting Cisco devices.

Use straight-through cables for the following cabling:

* Switch to router
* Switch to PC or server
* Hub to PC or server

Use crossover cables for the following cabling:

* Switch to switch
* Switch to hub
* Hub to hub
* Router to router
* PC to PC
* Router to PC

Figure illustrates how a variety of cable types may be required in a given network. The category of UTP cable required is based on the type of Ethernet that is chosen.

Repeaters
The term repeater comes from the early days of long distance communication. The term describes the situation when a person on one hill would repeat the signal that was just received from the person on the previous hill. The process would repeat until the message arrived at its destination. Telegraph, telephone, microwave, and optical communications use repeaters to strengthen signals sent over long distances.

A repeater receives a signal, regenerates it, and passes it on. It can regenerate and retime network signals at the bit level to allow them to travel a longer distance on the media. The Four Repeater Rule for 10-Mbps Ethernet should be used as a standard when extending LAN segments. This rule states that no more than four repeaters can be used between hosts on a LAN. This rule is used to limit latency added to frame travel by each repeater. Too much latency on the LAN increases the number of late collisions and makes the LAN less efficient.

Hubs
Hubs are actually multiport repeaters. In many cases, the difference between the two devices is the number of ports that each provides. While a typical repeater has just two ports, a hub generally has from four to twenty-four ports. Hubs are most commonly used in Ethernet 10BASE-T or 100BASE-T networks, although there are other network architectures that use them as well.

Using a hub changes the network topology from a linear bus, where each device plugs directly into the wire, to a star. With hubs, data arriving over the cables to a hub port is electrically repeated on all the other ports connected to the same network segment, except for the port on which the data was sent.

Hubs come in three basic types:

* Passive – A passive hub serves as a physical connection point only. It does not manipulate or view the traffic that crosses it. It does not boost or clean the signal. A passive hub is used only to share the physical media. As such, the passive hub does not need electrical power.
* Active – An active hub must be plugged into an electrical outlet because it needs power to amplify the incoming signal before passing it out to the other ports.
* Intelligent – Intelligent hubs are sometimes called smart hubs. These devices basically function as active hubs, but also include a microprocessor chip and diagnostic capabilities. Intelligent hubs are more expensive than active hubs, but are useful in troubleshooting situations.

Devices attached to a hub receive all traffic traveling through the hub. The more devices there are attached to the hub, the more likely there will be collisions. A collision occurs when two or more workstations send data over the network wire at the same time. All data is corrupted when that occurs. Every device connected to the same network segment is said to be a member of a collision domain.

Sometimes hubs are called concentrators, because hubs serve as a central connection point for an Ethernet LAN.

Wireless
A wireless network can be created with much less cabling than other networks. Wireless signals are electromagnetic waves that travel through the air. Wireless networks use Radio Frequency (RF), laser, infrared (IR), or satellite/microwaves to carry signals from one computer to another without a permanent cable connection. The only permanent cabling can be to the access points for the network. Workstations within the range of the wireless network can be moved easily without connecting and reconnecting network cabling.

A common application of wireless data communication is for mobile use. Some examples of mobile use include commuters, airplanes, satellites, remote space probes, space shuttles, and space stations.

At the core of wireless communication are devices called transmitters and receivers. The transmitter converts source data to electromagnetic (EM) waves that are passed to the receiver. The receiver then converts these electromagnetic waves back into data for the destination. For two-way communication, each device requires a transmitter and a receiver. Many networking device manufacturers build the transmitter and receiver into a single unit called a transceiver or wireless network card. All devices in wireless LANs (WLANs) must have the appropriate wireless network card installed.

The two most common wireless technologies used for networking are IR and RF. IR technology has its weaknesses. Workstations and digital devices must be in the line of sight of the transmitter in order to operate. An infrared-based network suits environments where all the digital devices that require network connectivity are in one room. IR networking technology can be installed quickly, but the data signals can be weakened or obstructed by people walking across the room or by moisture in the air. There are, however, new IR technologies being developed that can work out of sight.

Radio Frequency technology allows devices to be in different rooms or even buildings. The limited range of radio signals restricts the use of this kind of network. RF technology can be on single or multiple frequencies. A single radio frequency is subject to outside interference and geographic obstructions. Furthermore, a single frequency is easily monitored by others, which makes the transmissions of data insecure. Spread spectrum avoids the problem of insecure data transmission by using multiple frequencies to increase the immunity to noise and to make it difficult for outsiders to intercept data transmissions.

Two approaches currently being used to implement spread spectrum for WLAN transmissions are Frequency Hopping Spread Spectrum (FHSS) and Direct Sequence Spread Spectrum (DSSS). The technical details of how these technologies work are beyond the scope of this course.

Bridges
There are times when it is necessary to break up a large LAN into smaller, more easily managed segments. This decreases the amount of traffic on a single LAN and can extend the geographical area past what a single LAN can support. The devices that are used to connect network segments together include bridges, switches, routers, and gateways. Switches and bridges operate at the Data Link layer of the OSI model. The function of the bridge is to make intelligent decisions about whether or not to pass signals on to the next segment of a network.

When a bridge receives a frame on the network, the destination MAC address is looked up in the bridge table to determine whether to filter, flood, or copy the frame onto another segment. This decision process occurs as follows:

* If the destination device is on the same segment as the frame, the bridge blocks the frame from going on to other segments. This process is known as filtering.
* If the destination device is on a different segment, the bridge forwards the frame to the appropriate segment.
* If the destination address is unknown to the bridge, the bridge forwards the frame to all segments except the one on which it was received. This process is known as flooding.

If placed strategically, a bridge can greatly improve network performance.

Switches
A switch is sometimes described as a multiport bridge. While a typical bridge may have just two ports linking two network segments, the switch can have multiple ports depending on how many network segments are to be linked. Like bridges, switches learn certain information about the data packets that are received from various computers on the network. Switches use this information to build forwarding tables to determine the destination of data being sent by one computer to another computer on the network.

Although there are some similarities between the two, a switch is a more sophisticated device than a bridge. A bridge determines whether the frame should be forwarded to the other network segment based on the destination MAC address. A switch has many ports with many network segments connected to them. A switch chooses the port to which the destination device or workstation is connected. Ethernet switches are becoming popular connectivity solutions because, like bridges, switches improve network performance by improving speed and bandwidth.

Switching is a technology that alleviates congestion in Ethernet LANs by reducing the traffic and increasing the bandwidth. Switches can easily replace hubs because switches work with existing cable infrastructures. This improves performance with a minimum of intrusion into an existing network.

In data communications today, all switching equipment performs two basic operations. The first operation is called switching data frames. Switching data frames is the process by which a frame is received on an input medium and then transmitted to an output medium. The second is the maintenance of switching operations where switches build and maintain switching tables and search for loops.

Switches operate at much higher speeds than bridges and can support new functionality, such as virtual LANs.

An Ethernet switch has many benefits. One benefit is that an Ethernet switch allows many users to communicate in parallel through the use of virtual circuits and dedicated network segments in a virtually collision-free environment. This maximizes the bandwidth available on the shared medium. Another benefit is that moving to a switched LAN environment is very cost effective because existing hardware and cabling can be reused.

Host connectivity
The function of a NIC is to connect a host device to the network medium. A NIC is a printed circuit board that fits into the expansion slot on the motherboard or peripheral device of a computer. The NIC is also referred to as a network adapter. On laptop or notebook computers a NIC is the size of a credit card.

NICs are considered Layer 2 devices because each NIC carries a unique code called a MAC address. This address is used to control data communication for the host on the network. More will be learned about the MAC address later. As the name implies, the network interface card controls host access to the medium.

In some cases the type of connector on the NIC does not match the type of media that needs to be connected to it. A good example is a Cisco 2500 router. On the router an AUI connector is seen. That AUI connector needs to connect to a UTP Cat 5 Ethernet cable. To do this a transmitter/receiver, also known as a transceiver, is used. A transceiver converts one type of signal or connector to another. For example, a transceiver can connect a 15-pin AUI interface to an RJ-45 jack. It is considered a Layer 1 device because it only works with bits, and not with any address information or higher-level protocols.

In diagrams, NICs have no standardized symbol. It is implied that, when networking devices are attached to network media, there is a NIC or NIC-like device present. Wherever a dot is seen on a topology map, it represents either a NIC interface or port, which acts like a NIC.

Peer-to-peer
By