Lesson 1:Ethernet

Ethernet is the most popular local area network (LAN) protocol operating at the data-link layer; it has been for decades. In most cases, when people talk about a LAN, they are referring to an Ethernet LAN. The Ethernet protocol was developed in the 1970s and has since been upgraded repeatedly to satisfy the changing requirements of networks and network users. Today's Ethernet networks run at speeds of 10, 100, and 1000 Mbps (1 Gbps), enabling them to fulfill roles ranging from home and small business networks to high-capacity backbones.

---

After this lesson, you will be able to

• List the Ethernet physical layer standards
• Describe the functions of the Ethernet frame
• Understand the Carrier Sense Multiple Access with Collision Detection (CSMA/CD) Media Access Control (MAC) mechanism

Estimated lesson time: 50 minutes

---

Ethernet Standards

There have been two sets of Ethernet standards over the years. The first was the original Ethernet protocol, as developed by Digital Equipment Corporation, Intel, and Xerox, which came to be known as DIX Ethernet. The DIX Ethernet standard was first published in 1980 and defined a network running at 10 Mbps using RG-8 coaxial cable in a bus topology. This standard is known as thick Ethernet, ThickNet, or 10Base5. The DIX Ethernet II standard, published in 1982, added a second physical layer option to the protocol using RG-58 coaxial cable. This standard is called thin Ethernet, ThinNet, Cheapernet, or 10Base2.

Around the same time that these standards were published, an international standards-making body called the Institute of Electrical and Electronic Engineers (IEEE) set about creating an international standard defining this type of network, which would not be held in private hands, as was the DIX Ethernet standard. In 1980, the IEEE assembled what they called a working group with the designation IEEE 802.3 that began the development of an Ethernet-like network standard. They couldn't call their network Ethernet because Xerox had trademarked the name, but in 1985, they published IEEE 802.3 Carrier Sense Multiple Access with Collision Detection (CSMA/CD) Access Method and Physical Layer Specifications. This document included specifications for networks using the same two coaxial cable options as DIX Ethernet and, after further development, added a specification for an unshielded twisted pair (UTP) cable option known as 10Base-T. Additional documents published by the IEEE 802.3 working group in later years include IEEE 802.3u in 1995, which defines the 100-Mbps Fast Ethernet specifications, and IEEE 802.3z and IEEE 802.3ab, which are the 1000-Mbps Gigabit Ethernet standards.

The IEEE 802.3 standard differs only slightly from the DIX Ethernet standard. The IEEE standard contains additional physical layer options, as already noted, and some differences in the frame format. Despite the continued use of the name Ethernet in the marketplace, however, the protocol that networks use today is actually IEEE 802.3, because this version provides the additional physical layer options and the Fast Ethernet and Gigabit Ethernet standards. Development of the DIX Ethernet standards ceased after Ethernet II, and coaxial cable Ethernet is all but obsolete. When people use the term Ethernet today, it is understood that they actually mean IEEE 802.3. The only element of the DIX Ethernet standard still in common use is the Ethernet II frame format, which contains the Ethertype field that is used to identify the network layer protocol that generated the data in each packet.

Both the IEEE 802.3 and DIX Ethernet standards consist of the following three basic components:

• Physical layer specifications
• Frame format
• CSMA/CD MAC mechanism

Physical Layer Specifications

The physical layer specifications included in the Ethernet standards describe the types of cables you can use to build the network, define the topology, and provide other crucial guidelines, such as the maximum cable lengths and the number of repeaters you can use. The basic specifications for the Ethernet physical layer options are listed in Table 5.1. Observing these guidelines is an important part of building a reliable Ethernet network, because they limit the effects of problems like attenuation and crosstalk, which are common to all networks and can inhibit the functionality of the CSMA/CD mechanism. The precise timing involved in Ethernet's collision detection mechanism makes the length of the network cables and the number of repeaters used to build the network highly significant to its smooth operation.

Table 5.1  Ethernet Physical Layer Specifications

Designation	Cable Type	Topology	Speed	Maximum Segment Length
10Base5	RG-8 coaxial	Bus	10 Mbps	500 meters
10Base2	RG-58 coaxial	Bus	10 Mbps	185 meters
10Base-T	Category 3 UTP	Star	10 Mbps	100 meters
Fiber Optic Inter-Repeater Link (FOIRL)	62.5/125 multimode fiber optic	Star	10 Mbps	1000 meters
10Base-FL	62.5/125 multimode fiber optic	Star	10 Mbps	2000 meters
10Base-FB	62.5/125 multimode fiber optic	Star	10 Mbps	2000 meters
10Base-FP	62.5/125 multimode fiber optic	Star	10 Mbps	500 meters
100Base-TX	Category 5 UTP	Star	100 Mbps	100 meters
100Base-T4	Category 3 UTP	Star	100 Mbps	100 meters
100Base-FX	62.5/125 multimode fiber optic	Star	100 Mbps	412 meters
1000Base-LX	9/125 singlemode fiber optic	Star	1000 Mbps	5000 meters
1000Base-LX	50/125 or 62.5/125 multimode fiber optic	Star	1000 Mbps	550 meters
1000Base-SX	50/125 multimode fiber optic (400 MHz)	Star	1000 Mbps	500 meters
1000Base-SX	50/125 multimode fiber optic (500 MHz)	Star	1000 Mbps	550 meters
1000Base-SX	62.5/125 multimode fiber optic (160 MHz)	Star	1000 Mbps	220 meters
1000Base-SX	62.5/125 multimode fiber optic (200 MHz)	Star	1000 Mbps	275 meters
1000Base-LH	9/125 singlemode fiber optic	Star	1000 Mbps	10 km
1000Base-ZX	9/125 singlemode fiber optic	Star	1000 Mbps	100 km
1000Base-CX	150-ohm shielded copper cable	Star	1000 Mbps	25 meters
1000Base-T	Category 5 (or 5E) UTP	Star	1000 Mbps	100 meters

For more information about the actual cables used to build Ethernet networks, see Lesson 1: Network Cables, in Chapter 2, "Network Hardware."

Coaxial Ethernet

The coaxial Ethernet standards (10Base5 and 10Base2) are the only ones that call for a bus topology. The maximum segment length indicates the length of the entire bus, from one terminator to the other, with all of the computers in between, as shown in Figure 5.1. A cable segment that connects more than two computers is called a mixing segment. The coaxial standards are no longer in use, except on a few older networks, because coaxial cable is more difficult to install and maintain than UTP and it is limited to a maximum speed of 10 Mbps.

Figure 5.1  Ethernet's coaxial cable specifications use a mixing segment to connect multiple computers to the network

UTP Ethernet

All of the other Ethernet physical layer specifications use the star topology, in which a separate cable segment connects each computer to a hub. A cable segment that connects only two devices is called a link segment. UTP is the most popular type of cable used on Ethernet networks today because it is easy to install and it is upgradeable from 10 Mbps to 100 or even 1000 Mbps. 10Base-T Ethernet uses link segments up to 100 meters long to connect computers to a repeating hub, which enables the incoming signals to go out to a computer another 100 meters away, as shown in Figure 5.2. 10Base-T uses only two of the four wire pairs in the cable, one pair for transmitting data and one pair for receiving it.

Even though there are two pairs of wires left unused on many UTP networks, do not be tempted to run voice telephone or other signals over those other two pairs while the network is in use. This practice can lead to excessive signal interference due to crosstalk between the wires.

Figure 5.2  UTP cables can connect Ethernet systems to a hub 100 meters away, and the hub repeats the signal to another hub or computer

The Fast Ethernet standard (IEEE 802.3u) includes two UTP cable specifications, known collectively as 100Base-T, both of which retain the 100-meter maximum segment length. 100Base-TX does this by requiring a higher grade of cable, Category 5 (the current industry standard), which provides better signal transmission capabilities. 100Base-T4, however, provides increased speed using the same Category 3 cable as older Ethernet and telephone networks. The difference between the two is that 100Base-TX uses only two pairs of wires, just like 10Base-T, whereas 100Base-T4 uses all four wire pairs. In addition to the transmit and receive pairs, 100Base-T4 uses the other two pairs for bidirectional communications.

Most of the physical layer specifications for Gigabit Ethernet defined in the IEEE 802.3z standard use fiber optic cable, but there is one UTP option, defined in a separate document called IEEE 802.3ab, that does not. The 1000Base-T standard, designed specifically as an upgrade for existing UTP networks with 100-meter cable segments, calls for Category 5 cable, but is better serviced by the higher performance cables now being marketed as Enhanced Category 5 or Category 5E. The Electronics Industry Association and Telecommunications Industry Association (EIA/TIA) have officially ratified the Category 5E cable rating, but the rating does not increase the performance of the cable substantially. The bandwidth of Category 5E is the same as that of Category 5, although its requirements for resistance to certain types of crosstalk are increased and some new performance parameters have been added. 1000Base-T achieves its great speed using all four wire pairs, like 100Base-T4, and by using a different signaling scheme called Pulse Amplitude Modulation-5 (PAM-5).

Fiber Optic Ethernet

Fiber optic cable has been an Ethernet physical layer option since its early days. The FOIRL was part of the DIX Ethernet II standard, and the IEEE 802.3 standards later included the 10Base-FL, 10Base-FB, and 10Base-FP specifications that were intended for various types of networks. None of these solutions were extremely popular because running a fiber optic network at 10 Mbps is a terrible waste of potential. Fiber Distributed Data Interface (FDDI, which is not a form of Ethernet) running at 100 Mbps soon became the fiber optic backbone protocol of choice. Later, Fast Ethernet arrived with its own 100 Mbps fiber optic option, 100Base-FX. 100Base-FX uses the same hardware as 10Base-FL, but it limits the length of a cable segment to 412 meters.

Gigabit Ethernet is the newest form of Ethernet, raising network transmission speed to 1000 Mbps. Gigabit Ethernet relies heavily on fiber optic cabling and provides a variety of physical layer options using different types of cable to achieve different segment lengths. Singlemode fiber cable is designed to span extremely long distances, making Gigabit Ethernet suitable for connecting distant networks or large campus backbones.

Cabling Guidelines

Repeating is an essential part of most Ethernet networks, and the standards include rules regarding the number of repeaters you can use on a single LAN. For the original 10-Mbps Ethernet standard, the use of repeaters is governed by the 5-4-3 rule, which states that you can have up to five cable segments, connected by four repeaters, with no more than three of these segments being mixing segments. In the days of coaxial cable networks, this meant that you could have up to three mixing segments of 500 or 185 meters each (for 10Base5 and 10Base2, respectively) populated with multiple computers and connected by two repeaters. You could also add two additional repeaters to extend the network with another two cable segments of 500 or 185 meters each, as long as these were link segments connected directly to the next repeater in line with no intervening computers, as shown in Figure 5.3. A 10Base2 network could therefore span up to 925 meters and a 10Base5 network up to 2500 meters.

For information about repeaters and their functions, see Lesson 3: Network Hubs, in Chapter 2, "Network Hardware."

Figure 5.3  Coaxial Ethernet networks consist of up to three mixing segments and two link segments, all connected by repeaters

On networks using the star topology, all of the segments are link segments, meaning that you can connect up to four repeating hubs using their uplink ports and still adhere to the 5-4-3 rule (see Figure 5.4). As long as the traffic between the two most distant computers doesn't pass through more than four hubs, the network is configured properly. Because the hubs function as repeaters, each 10Base-T cable segment can be up to 100 meters long, for a maximum network span of 500 meters.

Because Fast Ethernet networks run at higher speeds, they can't support as many hubs as 10-Mbps Ethernet. The Fast Ethernet standard defines two types of hubs, Class I and Class II, which must be marked with the appropriate Roman numeral in a circle. Class I hubs connect Fast Ethernet cable segments of different types, such as 100Base-TX to 100Base-T4 or UTP to fiber optic, whereas Class II hubs connect segments of the same type. You can have as many as two Class II hubs on a network, with a total cable length (for all three segments) of 205 meters when using UTP cable and 228 meters using fiber optic cable. Because Class I hubs must perform an additional signal translation, which slows down the transmission process, you can have only one hub on the network, with maximum cable lengths of 200 and 272 meters for UTP and fiber optic, respectively.

Figure 5.4  10Base-T Ethernet networks can have up to four repeating hubs connected together

The hub configuration rules for standard and Fast Ethernet given here are general guidelines that, in most cases, result in a network that functions properly. A certain amount of leeway in real-world configuration practices is understood to exist. For example, if all of your cable segments in a 10Base-T network are substantially shorter than 100 meters (and they usually are), you can probably get away with adding a fifth hub. To ensure that your network conforms to the specifications, it is possible to achieve greater accuracy by calculating the precise round-trip delay time for your network, which is the time it takes for a packet to travel between the two most distant systems on the network. You can calculate it by using specific values for each meter of cable and each type of hub.

The 1000Base-T cabling guidelines are simple. Because of the high transmission speed, only one repeater is permitted on the network. Although Gigabit Ethernet theoretically supports half-duplex operation with the use of hubs, there are no products like this on the market. All Gigabit Ethernet implementations are full-duplex and use switches to connect the network nodes together.

The Ethernet Frame

One of the primary functions of the Ethernet protocol is to encapsulate the data it receives from the network layer protocol in a frame, in preparation for its transmission across the network. The frame consists of a header and a footer that are divided into fields containing specific information needed to get each packet to its destination. Regular, Fast, and Gigabit Ethernet all use the same frame, the format of which is shown in Figure 5.5.

Figure 5.5  The Ethernet/IEEE 802.3 frame

The functions of the Ethernet frame fields are as follows:

• Preamble (7 bytes).  This field contains 7 bytes of alternating 0s and 1s, which the communicating systems use to synchronize their clock signals.
• Start Of Frame Delimiter (1 byte).  This field contains 6 bits of alternating 0s and 1s, followed by two consecutive 1s, which is a signal to the receiver that the transmission of the actual frame is about to begin.
• Destination Address (6 bytes).  This field contains the 6-byte hexadecimal address of the network interface adapter on the local network to which the packet will be transmitted.
• Source Address (6 bytes).  This field contains the 6-byte hexadecimal address of the network interface adapter in the system generating the packet.
• Ethertype/Length (2 bytes).  In the DIX Ethernet frame, this field contains a code identifying the network layer protocol for which the data in the packet is intended. In the IEEE 802.3 frame, this field specifies the length of the data field (excluding the pad).
• Data And Pad (46 to 1500 bytes).  This field contains the data received from the network layer protocol on the transmitting system, which is sent to the same protocol on the destination system. Ethernet frames (including the header and footer, except for the Preamble and Start Of Frame Delimiter) must be at least 64 bytes long; so if the data received from the network layer protocol is less than 46 bytes, the system adds padding bytes to bring it up to its minimum length.
• Frame Check Sequence (4 bytes).  The frame's footer is a single field that comes after the network layer protocol data and contains a 4-byte checksum value for the entire packet. The sending computer computes this value and places it into the field. The receiving system performs the same computation and compares it to the field to verify that the packet was transmitted without error.

Ethernet Addressing

The Destination Address and Source Address fields use the 6-byte hardware addresses coded into network interface adapters to identify systems on the network. Every network interface adapter has a unique hardware address (also called a MAC address), which consists of a 3-byte value called an organizationally unique identifier (OUI), which is assigned to the adapter's manufacturer by the IEEE, plus another 3-byte value assigned by the manufacturer itself.

Ethernet, like all data-link layer protocols, is concerned only with transmitting packets to another system on the local network. If the packet's final destination is another system on the LAN, the Destination Address field contains the address of that system's network adapter. If the packet is destined for a system on another network, the Destination Address field contains the address of a router on the local network that provides access to the destination network. It is then up to the network layer protocol to supply a different kind of address (such as an Internet Protocol [IP] address) for the system that is the packet's ultimate destination.

Ethertypes

The 2-byte field after the Source Address field is the primary difference between the DIX Ethernet and IEEE 802.3 standards. For any network that uses multiple protocols at the network layer, it is essential for the Ethernet frame to somehow identify which network layer protocol has generated the data in a particular packet. The DIX Ethernet frame does this simply by specifying an Ethertype in this field, using values like those shown in Table 5.2. The IEEE 802.3 standard uses this field to specify the length of the data field.

Table 5.2  Common Ethertype Values, in Hexadecimal

Network Layer Protocol	Ethertype
IP	0800
X.25	0805
Address Resolution Protocol (ARP)	0806
Reverse ARP	8035
AppleTalk on Ethernet	809B
NetWare Internetwork Packet Exchange (IPX)	8137

IEEE 802.3 takes a different approach. In this frame, the field after the Source Address specifies the length of the data in the packet. The frame uses an additional component, the Logical Link Control (LLC), to identify the network layer protocol. The IEEE's 802 working group is not devoted solely to the development of Ethernet-like protocols. In fact, there are other protocols that fit into the IEEE 802 architecture, the most prominent of which (aside from IEEE 802.3) is IEEE 802.5, which is a Token Ring–like protocol. To make the IEEE 802 architecture adaptable to these various protocols, the data-link layer is split into two sublayers, as shown in Figure 5.6.

Figure 5.6  The IEEE 802 protocols split the data-link layer into two sublayers, the MAC layer and the LLC layer

The MAC sublayer is the part that contains the elements particular to the IEEE 802.3 specification, such as the Ethernet physical layer options, the frame, and the CSMA/CD MAC mechanism. The functions of the LLC sublayer are defined in a separate document, published as IEEE 802.2. This same LLC sublayer is also used with the MAC sublayers of other IEEE 802 protocols, such as 802.5.

The LLC standard defines an additional 3-byte or 4-byte subheader that is carried within the Data field, which contains service access points (SAPs) for the source and destination systems. These SAPs identify locations in memory where the source and destination systems store the packet data. To provide the same function as the Ethertype field, the LLC subheader can use a SAP value of 170, which indicates that the Data field also contains a second subheader called the Subnetwork Access Protocol (SNAP). The SNAP subheader is 5 bytes long and contains a 2-byte Local Code that performs the same function as the Ethertype field in the Ethernet II header.

It is typical for computers on a Transmission Control Protocol/Internet Protocol (TCP/IP) network to use the Ethernet II frame because the Ethertype field performs the same function as the LLC and SNAP subheaders and saves 8 to 9 bytes per packet. Microsoft Windows servers and clients automatically negotiate a common frame type when communicating, and when you install a Novell NetWare server, you can select the frame type you want to use. There are two crucial factors to be aware of when it comes to Ethernet frame types. First, computers must use the same frame type to communicate. Second, if you are using multiple network layer protocols on your network, such as TCP/IP for Windows networking and IPX for NetWare, you must use a frame type that contains an Ethertype or its functional equivalent, such as Ethernet II or Ethernet SNAP.

CSMA/CD

The MAC mechanism is the single most defining element of the Ethernet standard. A protocol that is very similar to Ethernet in other ways, such as the short-lived 100Base-VG-AnyLAN, is placed in a separate category because it uses a different MAC mechanism. CSMA/CD may be a confusing name, but the basic concept is simple. Only when you get into the details do things become complicated.

When an Ethernet system has data to transmit, it first listens to the network to see if it is in use by another system. This is the carrier sense phase. If the network is busy, the system does nothing for a given period and then checks again. If the network is free, the system transmits the data packet. This is called the multiple access phase because all of the systems on the network are contending for access to the same network medium.

Run the CSMA video located in the Demos folder on the CD-ROM accompanying this book for a demonstration of the carrier sense and multiple access phases.

Even though an initial check is performed during the carrier sense phase, it is still possible for two systems on the network to transmit at the same time, causing a collision. For example, when a system performs the carrier sense, another computer has already begun transmitting, but its signal has not yet reached the sensing system. The second computer then transmits and the two packets collide somewhere on the cable. When a collision occurs, both packets are discarded and the systems must retransmit them. These collisions are a normal and expected part of Ethernet networking, and they are not a problem unless there are too many of them or the computers are unable to detect them.

Run the Collision video located in the Demos folder on the CD-ROM accompanying this book for a demonstration of a collision.

Although the term collision is commonly used, the IEEE 802.3 standard refers to the condition as a signal quality error (SQE). This is a common practice for these standards, which often use complicated terminology when a simple phrase will do.

The collision detection phase of the transmission process is the most important part of the operation. If the systems can't tell when their packets collide, corrupted data may reach the destination system and be treated as valid. Ethernet networks are designed so that packets are large enough to fill the entire network cable with signals before the last bit leaves the transmitting computer. This is why Ethernet packets must be at least 64 bytes long, systems pad out short packets to 64 bytes before transmission, and the Ethernet physical layer guidelines impose strict limitations on the lengths of cable segments.

As long as a computer is still in the process of transmitting, it is capable of detecting a collision on the network. On a UTP or fiber optic network, a computer assumes that a collision has occurred if it detects signals on both its transmit and receive wires at the same time. On a coaxial network, a voltage spike indicates the occurrence of a collision. If the network cable is too long or if the packet is too short, a system might finish transmitting before the collision occurs.

It is conceivable that collisions might occur after the last bit of data has left the transmitting system. This is called a late collision, and it is not a normal Ethernet occurrence. Late collisions are an indication of a serious problem, such as a malfunctioning network interface card (NIC), and must be corrected as soon as possible.

When a system detects a collision, it immediately stops transmitting data and starts sending a jam pattern instead. The jam pattern serves as a signal to each system on the network that a collision has taken place, that it should discard any partial packets it may have received, and that it should not attempt to transmit any data until the network has cleared. After transmitting the jam pattern, the system waits a specified period of time before attempting to transmit again. This is called the backoff period, and both of the systems involved in a collision compute the length of their own backoff periods using a randomized algorithm called truncated binary exponential backoff. They do this to try to avoid causing another collision by backing off for the same period of time.

Because of the way CSMA/CD works, the more systems you have on a network or the more data the systems transmit over the network, the more collisions there are. Collisions are a normal part of Ethernet operation, but they cause delays, because systems have to retransmit packets. When the number of collisions is minimal, the delays aren't noticeable, but when network traffic increases, the number of collisions increases, and the accumulated delays can begin to have a palpable effect on network performance. For this reason, it is not a good idea to run an Ethernet network at high traffic levels. You can reduce the traffic on the network by installing a bridge or switch or by splitting it into two LANs and connecting them with a router.

Using CSMA/CD may seem to be an inefficient way of controlling access to the network medium, but the process by which the systems contend for access to the network and recover from collision occurs many times per second, so rapidly that the delays caused by a moderate number of collisions are negligible.

Run the Contention video located in the Demos folder on the CD-ROM accompanying this book for a demonstration of how Ethernet systems contend for access to the network.

Exercise 1: CSMA/CD Procedures

Place the following steps of the CSMA/CD transmission process in the proper order.

1. System begins transmitting data
2. System retransmits data
3. System detects incoming signal on receive wires
4. System backs off
5. System listens to the network
6. System stops transmitting data
7. System transmits jam pattern
8. System detects no network traffic

Lesson Review

1. What does an Ethernet system generate when it detects a collision?
   1. A beacon frame
   2. An error message
   3. A jam signal
   4. None of the above
2. Which of the following is not a required component of a 10Base-T Ethernet network?
   1. Network interface adapters or NICs
   2. Cables
   3. A hub
   4. Computers
3. To achieve 100 Mbps speed over Category 3 cable, 100Base-T4 Ethernet uses which of the following?
   1. PAM-5 signaling
   2. Quartet signaling
   3. CSMA/CD
   4. All four wire pairs
4. In which of the following standards is Gigabit Ethernet defined?
   1. IEEE 802.2
   2. IEEE 802.3
   3. IEEE 802.3u
   4. IEEE 802.3z
5. List the hardware components that you have to replace when upgrading a 10-year-old 10Base-T network to 100Base-TX.
6. How could you upgrade a 10-year-old 10Base-T network to Fast Ethernet without replacing the cables?
7. Which Fast Ethernet physical layer option is best suited for a connection between two campus buildings 200 meters apart? Why?
8. Which of the following is a valid MAC address?
   1. 00:B0:A1:8C:32:65:BB
   2. 01:DB:7F:86:E4:6G
   3. 00:D0:B7:AD:1A:7B
   4. 03:BC:5A:E6:E4

Lesson Summary

• There are two sets of Ethernet standards: DIX Ethernet and IEEE 802.3, which differ primarily in their frame formats.
• Ethernet supports many different physical layer configurations, using various types of cables: coaxial, twisted pair, and fiber optic.
• Ethernet uses the CSMA/CD MAC mechanism, which relies on the ability of the computers to detect packet collisions when they occur.