Networking: LANs, Topologies, Ethernet

Basic Terms

• A LAN is a computer network spanning a relatively small area
• Physical topology refers to the physical layout or arrangement of devices on a network
• Logical topology describes how data passes through the media from one device to the next, independent of the physical topology
• A hub is a Layer 1 device used to connect devices in a network and broadcasts incoming packets to all connected devices
• A switch is a Layer 2 device used to filter and forward data and initially broadcasts, then uses unicast or multicast as needed
• A MAC address is a unique hardware address (physical address) that identifies each node on a network

Ethernet Protocols Overview

• Ethernet is the most widely used wired LAN technology and standard and is implemented as a physical bus or star with a logical bus topology
• It uses CSMA/CD for media access in a CSMA/CD network
• Ethernet typically uses coaxial cables and special grades of twisted pair wires
• Variations of Ethernet include 10 Mbps (10BASE-T), 100 Mbps (100BASE-T, Fast Ethernet), 1000 Mbps (Gigabit Ethernet), and 10,000 Mbps (10-Gigabit Ethernet)
• The Ethernet standard covers Data Link Layer Protocols and Physical Layer Technologies
• Ethernet is defined by data link layer and physical layer protocols

Physical and Data Link Layers

• At Layer 1, Ethernet involves bit streams, encoding, signaling and placing signals on media, as well as various network topologies and hardware specifications
• Ethernet Layer 1 alone is not sufficient to describe a LAN technology

Data Link Layer

• The LLC sublayer (IEEE802.2) interfaces with upper and lower layers, which include networking software and device hardware
• The LLC sublayer adds control information and assists in creating frames from packets for the lower layers
• In the context of a computer, the LLC can be considered the driver software for the NIC.

MAC Sublayer (IEEE802.3)

• The MAC sublayer deals with media access control methods and functions within the Physical Layer
• Media Access Control (MAC) is implemented by hardware, typically in the Network Interface Card (NIC)
• The two primary responsibilities of the Ethernet MAC sublayer are data encapsulation and media access control

Data Encapsulation

• Data encapsulation involves adding a header and trailer to the packet
• The three processes involved are:
  • Frame delimiting (boundaries) that provides start-of-frame and end-of-frame bits to create a frame for transmission
  • Addressing by including the MAC address in the header
  • Error detection by including a CRC value in the FCS field for error checking

Media Access Control

• Media access control governs putting/retrieving frames on the media, controlling the placement/retrieval of frames
• This sublayer communicates directly with the physical layer.
• The underlying logical topology for original Ethernet is multi-access bus topology
• All nodes share a single transmission medium in a contention-based (non-deterministic) network using CSMA/CD

Brief History of Ethernet

• The first version of Ethernet used coaxial cable to connect computers, known as Thicknet (10BASE5) and Thinnet (10BASE2), and had a speed of 10 Mbps
• Later, coaxial cables were replaced with twisted pair and fiber optic links, along with hubs and switches
• Hub-based Ethernet and Switch-based Ethernet emerged
• The physical topology changed to a star topology from a bus topology
• Data rates increased from 10 Mbps to 1000 Mbps (10Base-T, Fast Ethernet, Gigabit Ethernet)

Hub-based Ethernet (Legacy Ethernet)

• In hub-based Ethernet, devices are connected using a hub
• Its transmission mode is Half-duplex communication
• The hub broadcasts data to everyone, and only the intended receiver accepts the data by examining the MAC address
• Collisions are possible, handled using CSMA/CD

Switch-based Ethernet

• In switch-based Ethernet, devices are connected using a switch
• The transmission mode is Full-duplex communication
• The switch first broadcasts data, then learns the receiver before using unicast / multicast as needed
• Collisions do not occur

CSMA/CD

• CSMA/CD was extensively used in early Ethernet technology or LANs
• It is no longer used in modern Ethernet networks designed with switches and full-duplex connections
• To transmit, each host listens on the media
• If a signal from another device is present, it will wait for a specific amount of time and listen again
• If no signal is present, the host transmits
• If two devices transmit at the same time, it leads to a collision
• Both devices detect the collision and send out a jamming signal
• The jamming signal is detected by all devices, signaling that a collision has occurred
• The jamming signal causes each device to invoke a backoff algorithm, waiting a random amount of time before returning to listening mode, preventing repeated collisions

Ethernet Frame

• Ethernet II is the Ethernet frame format used in TCP/IP networks
• The Ethernet standard frame has a minimum frame size of 64 bytes and a maximum of 1518 bytes
• If the size of a transmitted frame is not within the range, the receiver drops the frame
• Undersized frames are referred to as "collision fragments" or "runt frames", while oversized ones are "jumbo" or "baby giant frames"

Revised IEEE 802.3 (Ethernet II) Frame Fields

• Preamble and Start Frame Delimiter Fields (8 bytes are used for synchronization between the sender and receiver and to get the attention of the receiver (a frame is coming)
• Destination MAC Address Field (6 bytes) serves as the identifier for the intended recipient
• Source MAC Address Field (6 bytes) identifies the original sender
• Length / Type Field (2 bytes) indicates the length of the Data Field or describes which higher-layer protocol is present
• Data Field (46 - 1500 bytes) contains the encapsulated data (Packet) from a higher layer, such as the Network Layer
• Frame Check Sequence Field (4 bytes) consists of CRC is used to detect errors in a frame

Ethernet MAC Address

• The Ethernet MAC address is a 48-bit physical address represented in 12 HEX digits
• The first 6 HEX digits identify the manufacturer or vendor
• The remaining 6 HEX digits comprise the interface serial number, which is unique to each device
• The MAC address is also known as a burned-in address (BIA) because it is permanently burned into ROM (Read-Only Memory) on the NIC
• MAC addresses are non-hierarchical.
• They have no meaning outside the local network media.
• MAC addresses are used only in local networks
• A Network (IP) Address is required (by the Router) to forward packets to other destination networks

Ethernet Unicast, Broadcast and Multicast

• Ethernet uses different MAC addresses for Layer 2 unicast, broadcast, and multicast communications
• The Ethernet Unicast process refers to sending a frame from one host to an individual host
• For a unicast packet to be sent and received, a destination IP address must be in the IP packet header, paired with a corresponding destination MAC address in the Ethernet frame header
• The IP address and MAC address combine to deliver data to one specific destination host
• The Ethernet Broadcast process is sending a frame from one host to ALL hosts in the network
• A broadcast packet contains a destination IP address with all ones (1s) in the host portion with a broadcast MAC address of 48 ones (1s) displayed as hexadecimal FF-FF-FF-FF-FF-FF
• Ethernet Multicast is the process of sending a packet from one host to a SELECTED group of hosts
• Devices belonging to a multicast group are assigned a special multicast group IP address between 224.0.0.0 to 239.255.255.255
• The multicast MAC address is a special value that begins with 01-00-5E in hexadecimal, with the rest coming from converting the lower 24 bits of the IP multicast group address into 6 hexadecimal characters in the format 01-00-5E-xx-xx-xx

LAN Switches

• An Ethernet switch is a Layer 2 device that uses MAC addresses to make forwarding decisions
• Unlike a hub, which broadcasts frames, an Ethernet switch consults a MAC address table (stored in RAM) to make a forwarding decision for each frame

Learning and Forwarding MAC Addresses

• The switch dynamically builds the MAC address table by examining the source MAC address of the frames received on a port
• If the source MAC address doesn't exist, it is added to the table along with the incoming port number
• If it exists, the switch updates the refresh timer for that entry
• When forwarding a frame, the switch looks for a matched record in its MAC address table
• The switch will forward the frame out of the specified port if the destination MAC address is in the table
• Otherwise, the switch will forward the frame out of all ports except the incoming port if the destination MAC address is not in the table

Frame Forwarding Methods on Cisco Switches

• Store-and-forward switches receive the entire frame and computes the CRC
• The switch looks up the destination address to determine the outgoing interface if the CRC is valid, the frame is forwarded
• Cut-through switches forward the frame before it is entirely received with the destination address of the frame being read before the frame can be forwarded

Auto-MDIX

• Connections between devices like switch-to-switch and router-to-host used to require specific cable types
• Most switch devices now support the automatic medium-dependent interface crossover (auto-MDIX) feature that detects the cable type attached to a port and configures the interfaces
• Auto-MDIX is enabled by default on switches since IOS 12.2(18)SE and can be enabled using the "mdix auto" interface configuration command

Address Resolution Protocol (ARP)

• When a host wants to send a frame to another host on the same LAN, the source host must know both the physical and logical addresses of the destination host
• To determine the destination MAC address, the device uses Address Resolution Protocol (ARP) to discover the MAC address of any host on the same local network
• The mapping between the IP and the MAC address will be stored in ARP table in the source host once the MAC address is obtained
• The sending host will broadcast the ARP Request message (which contains the IP address of the destination device) to the entire LAN
• Every device on the LAN will examine the ARP Request to see if it contains its own IP address
• Only the device with the IP address contained in the ARP Request responds with an ARP Reply
• The ARP Reply includes the MAC address associated with the IP address in the ARP Request

ARP Issues

• ARP requests are received and processed by every device on the local network which can cause excessive ARP broadcasts which can reduce performance
• Attackers can respond to requests and pretend to provide services performing ARP spoofing