In this article, we will first focus our attention on the frame composition. In
reality, there is only one physical Ethernet frame. However, the composition of
the frame was altered by the IEEE when the CSMA/CD original Ethernet frame
format was standardized by that organization as the 802.3 frame. In addition,
the logical composition of the data field within the 802.3 frame can vary based
upon the protocol transported. the two-byte Ethernet type field. That field is
used by Ethernet to specify the protocol carried in the frame, enabling several
protocols to be carried independently of one another. Under the IEEE 802.3 frame
format, the type field was replaced by a two-byte length field, which specifies
the number of bytes that follow that field as data.
The differences between Ethernet and IEEE 802.3 frames, while minor, make the
two incompatible with one another. This means that your network must contain
either all Ethernet-compatible NICs or all IEEE 802.3 compatible NICs.
Fortunately, the fact that the IEEE 802.3 frame format represents a standard
means that almost all vendors now market 802.3-compliant hardware and software.
Although a few vendors continue to manufacture Ethernet or dual functioning
Ethernet/IEEE 802.3 hardware, such products are primarily used to provide
organizations with the ability to expand previously developed networks without
requiring the wholesale replacement of NICs.
Although the IEEE 802.3
frame does not directly support a type field within the frame, the IEEE defined
a special type of frame to obtain compatibility with Ethernet LANs. That frame
is referred to as an Ethernet Subnetwork Access Protocol (Ethernet-SNAP) frame,
which enables a type subfield to be included in the data field. While the IEEE
802.3 standard has essentially replaced Ethernet, because of their similarities
and the fact that 802.3 was based upon Ethernet, we will consider both to be
Ethernet. Now that we have an overview of the structure of Ethernet and 802.3
frames, let’s probe more deeply and examine the composition of each frame
field. We will take advantage of the similarity between Ethernet and IEEE 802.3
frames to examine the fields of each frame on a composite basis, noting the
differences between the two when appropriate.
Preamble
Field
The preamble field consists of eight (Ethernet) or seven (IEEE
802.3) bytes of alternating 1 and 0 bits. The purpose of this field is to
announce the frame and to enable all receivers on the network to synchronize
themselves to the incoming frame
Start-of-Frame Delimiter
Field
This field is applicable only to the IEEE 802.3 standard and
can be viewed as a continuation of the preamble. In fact, the composition of
this field continues in the same manner as the format of the preamble, with
alternating 1 and 0 bits used for the first six bit positions of this one-byte
field. The last two bit positions of this field are 11 this breaks the
synchronization pattern and alerts the receiver that frame data follows. Both
the preamble field and the start-of-frame delimiter field are removed by the
controller when it places a received frame in its buffer. Similarly, when a
controller transmits a frame, it prefixes the frame with those two fields (if it
is transmitting an IEEE 802.3 frame) or a preamble field (if it is transmitting
a true Ethernet frame).
Destination Address Field
The
destination address identifies the recipient of the frame. Although this may
appear to be a simple field, in reality its length can vary between IEEE 802.3
and Ethernet frames. In addition, each field can consist of two or more
subfields, whose settings govern such network operations as the type of
addressing used on the LAN, and whether the frame is addressed to a specific
station or more than one station. To obtain an appreciation for the use of this
field, let’s examine how this field is used under the IEEE 802.3 standard as
one of the two field formats applicable to Ethernet.
The two-byte source
and destination address fields are applicable only to IEEE 802.3 networks, while
the six- byte source and destination address fields are applicable to both
Ethernet and IEEE 802.3 networks. A user can select either a two- or six-byte
destination address field; however, with IEEE 802.3 equipment, all stations on
the LAN must use the same addressing structure. Today, almost all 802.3 networks
use six-byte addressing, because the inclusion of a two-byte field option was
designed primarily to accommodate early LANs that use 16- bit address
fields.
Both destination and source addresses are normally displayed by
network monitors in hexadecimal, with the first three bytes separated from the
last three by a colon (:) when six-byte addressing is used. For example, the
source address 02608C876543 would be displayed as 02608C:876543. As we will
shortly note, the first three bytes identify the manufacturer of the adapter
card, while the following three bytes identify a specific adapter manufactured
by the vendor identified by the first three bytes or six hex
digits.
I/G Subfield
The one-bit I/G subfield is set to a 0
to indicate that the frame is destined to an individual station, or 1 to
indicate that the frame is addressed to more than one station a group address.
One special example of a group address is the assignment of all 1s to the
address field. Hex ‘‘FFFFFFFFFFFF’’ is recognized as a broadcast
address, and each station on the network will receive and accept frames with
that destination address. An example of the use of a broadcast destination
address is the service advertising packet (SAP) transmitted every 60 seconds by
NetWare servers. The SAP is used to inform other servers and workstations on the
network of the presence of that server. Because the SAP uses a destination
address of FF-FF-FF-FF-FF-FF, it is recognized by every node on the
network.
When a destination address specifies a single station, the
address is referred to as a unicast address. A group address that defines
multiple stations is known as a multicast address, while a group address that
specifies all stations on the network is, as previously mentioned, referred to
as a broadcast address.
U/L Subfield
The U/L subfield is
applicable only to the six-byte destination address field. The setting of this
field’s bit position indicates whether the destination address is an address
that was assigned by the IEEE (universally administered) or assigned by the
organization via software (locally administered).
Universal versus
Locally Administered Addressing
Each Ethernet NIC contains a unique
address burned into its read-onlymemory (ROM) at the time of manufacture. To
ensure that this universally administered address is not duplicated, the IEEE
assigns blocks of addresses to each manufacturer. These addresses normally
include a three-byte prefix, which identifies the manufacturer and is assigned
by the IEEE, and a three-byte suffix, which is assigned by the adapter
manufacturer to its NIC. For example, the prefix 02608C identifies an NIC
manufactured by 3Com, while a prefix of hex 08002 identifies an NIC manufactured
by Digital Equipment Company, which was acquired by compaq
computer.
Although the use of universally administered addressing
eliminates the potential for duplicate network addresses, it does not provide
the flexibility obtainable from locally administered addressing. For example,
under locally administered addressing, you can configure mainframe software to
work with a predefined group of addresses via a gateway PC. Then, as you add new
stations to your LAN, you simply use your installation program to assign a
locally administered address to the NIC instead of using its universally
administered address. As long as your mainframe computer has a pool of locally
administered addresses that includes your recent assignment, you do not have to
modify your mainframe communications software configuration.
Becausethe
modification of mainframe communications software typically requires recompiling
and reloading, the attached network must become inoperative for a short period
of time. Because a large mainframe may service hundreds to thousands of users,
such changes are normally performed late in the evening or on a weekend. Thus,
the changes required for locally administered addressing are more responsive to
users accessing certain types of mainframe computers than those required for
universally administered addressing.
Source Address
Field
The source address field identifies the station that
transmitted the frame. Like the destination address field, the source address
can be either two or six bytes in length.
The two-byte source address is
supported only under the IEEE 802.3 standard and requires the use of a two-byte
destination address; all stations on the network must use two-byte addressing
fields. The six-byte source address field is supported by both Ethernet and the
IEEE 802.3 standard. When a six-byte address is used, the first three bytes
represent the address assigned by the IEEE to the manufacturer for incorporation
into each NIC’s ROM.
The vendor then normally assigns the last three
bytes for each of its NICs. Note that many organizations including Cisco
Systems, 3Com, IBM, MIPS, Ungermann-Bass, and Data General were assigned two or
more blocks of addresses by the IEEE.
Many software- and hardware-based
network analyzers include the capability to identify each station on a LAN,
count the number of frames transmitted by the station and destined to the
station, as well as identify the manufacturer of the NIC used in the station.
Concerning the latter capability, this is accomplished by the network analyzer
containing a table of three-byte identi- fiers assigned by the IEEE to each NIC
manufacturer, along with the name of the manufacturer. Then the analyzer
compares the three-byte identifier read from frames flowing on the network and
compares each identifier with the identifiers stored in its identifier table. By
providing information concerning network statistics, network errors, and the
vendor identifier for the NIC in each station, you may be able to isolate
problems faster or better consider future decisions concerning the acquisition
of additional NICs.
Type Field
The two-byte type field is
applicable only to the Ethernet frame. This field identifies the higher-level
protocol contained in the data field. Thus, this field tells the receiving
device how to interpret the data field. Under Ethernet, multiple protocols can
exist on the LAN at the same time. Xerox served as the custodian of Ethernet
address ranges licensed to NIC manufacturers and defined the protocols supported
by the assignment of type field values.
Frames with the hex value 0800 in
the type field would identify the IP protocol, while frames with the hex value
8137 in the type field would identify the transport of IPX and SPX protocols.
Thus, the placement of an appropriate hex value in the Ethernet type field
provides a mechanism to support the transport of multiple protocols on the local
area network. Under the IEEE 802.3 standard, the type field was replaced by a
length field, which precludes compatibility between pure Ethernet and 802.3
frames.
Length Field
The two-byte length field, applicable
to the IEEE 802.3 standard, defines the number of bytes contained in the data
field. Under both Ethernet and IEEE 802.3 standards, the minimum size frame must
be 64 bytes in length from preamble through FCS fields. This minimum size frame
ensures that there is sufficient transmission time to enable Ethernet NICs to
detect collisions accurately, based on the maximum Ethernet cable length
specified for a network and the time required for a frame to propagate the
length of the cable.
Based on the minimum frame length of 64 bytes and
the possibility of using two-byte addressing fields, this means that each data
field must be a minimum of 46 bytes in length. The only exception to the
preceding involves Gigabit Ethernet. At a 1000-Mbps operating rate the original
802.3 standard would not provide a frame duration long enough to permit a
100-meter cable run over copper media. This is because at a 1000-Mbps data rate
there is a high probability that a station could be in the middle of
transmitting a frame before it becomes aware of any collision that might have
occurred at the other end of the segment. Recognizing this problem resulted in
the development of a carrier extension, which extends the minimum Ethernet frame
to 512 bytes.
For all versions of Ethernet except Gigabit Ethernet, if
data being transported is less than 46 bytes, the data field is padded to obtain
46 bytes. However, the number of PAD characters is not included in the length
field value. NICs that support both Ethernet and IEEE 802.3 frame formats use
the value in this field to distinguish between the two frames. That is, because
the maximum length of the data field is 1,500 bytes, a value that exceeds hex
05DC indicates that instead of a length field (IEEE 802.3), the field is a type
field (Ethernet).
Data Field
As previously discussed, the
data field must be a minimum of 46 bytes in length to ensure that the frame is
at least 64 bytes in length. This means that the transmission of 1 byte of
information must be carried within a 46-byte data field; if the information to
be placed in the field is less than 46 bytes, the remainder of the field must be
padded. Although some publications subdivide the data field to include a PAD
subfield, the latter actually represents optional fill characters that are added
to the information in the data field to ensure a length of 46 bytes. The maximum
length of the data field is 1500 bytes.
Frame Check Sequence
Field
The frame check sequence field, applicable to both Ethernet and
the IEEE 802.3 standard, provides a mechanism for error detection. Each
transmitter computes a cyclic redundancy check (CRC) that covers both address
fields, the type/length field, and the data field. The transmitter then places
the computed CRC in the four- byte FCS field. The CRC treats the previously
mentioned fields as one long binary number. The n bits to be covered by the CRC
are considered to represent the coefficients
of a polynomial M(X) of
degree n - 1. Here, the first bit in the destination address field corresponds
to the Xn-1 term, while the last bit in the data field corresponds to the X0
term. Next, M(X) is multiplied by X32, and the result of that multiplication
process is divided by the following polynomial: G(X)=
X32+X26+X23+X22+X16+X12+X11+X10+X8+X7+X5+X4+X2+X+1 Note that the term Xn
represents the setting of a bit to a 1 in position n. Thus, part of the
generating polynomial X5 + X4 + X2 + X1 represents the binary value
11011.
This division produces a quotient and remainder. The quotient is
discarded, and the remainder becomes the CRC value placed in the four-byte FCS
field. This 32-bit CRC reduces the probability of an undetected error to 1 bit
in every 4.3 billion, or approximately 1 bit in 232 - 1 bits.
Once a
frame reaches its destination, the receiver uses the same polynomial to perform
the same operation upon the received data. If the CRC computed by the receiver
matches the CRC in the FCS field, the frame is accepted. Otherwise, the receiver
discards the received frame, as it is considered to have one or more bits in
error.
The receiver will also consider a received frame to be invalid and
discard it under two additional conditions. Those conditions occur when the
frame does not contain an integral number of bytes, or when the length of the
data field does not match the value contained in the length field. The latter
condition obviously is only applicable to the 802.3 standard, because an
Ethernet frame uses a type field instead of a length field.
Interframe
Gap
Under the 10-Mbps versions of the CSMA/CD protocol a 9.6
microsecond (µs) quiet time occurs between transmitted frames. This quiet time,
which is referred to as an interframe gap, permits clocking circuitry used
within repeaters and workstations and hub ports to be resynchronized to the
known local clock. Under Fast Ethernet the interframe gap is 0.96 ms, while
under Gigabit Ethernet the gap is reduced to 0.096 ms.
Last word from
the author
Thank you for reading my article, i hope you find it
rather usefull. If you have comments please post that here. Exclusive Article
written By Dave Ross for "Linux Exposed" Dave Ross Certified
Security Specialist
Be first to comment this article
