Saturday, September 29, 2007

TCP/IP PROTOCOL SUITE & APPLICATION LAYER

6.TCP/IP PROTOCOL SUITE & APPLICATION LAYER

6.1 TCP/IP :Introduction

The TCP/IP transport layer transports data between applications on source and destination devices. Familiarity with the transport layer is essential to understand modern data networks. This module will describe the functions and services of this layer.

Many of the network applications that are found at the TCP/IP application layer are familiar to most network users. HTTP, FTP, and SMTP are acronyms that are commonly seen by users of Web browsers and e-mail clients.This module also describes the function of these and other applications from the TCP/IP networking model.

6.1.1 Flow control

As the transport layer sends data segments, it tries to ensure that data is not lost. Data loss may occur if a host cannot process data as quickly as it arrives. The host is then forced to discard the data. Flow control ensures that a source host does not overflow the buffers in a destination host. To provide flow control, TCP allows the source and destination hosts to communicate.The two hosts then establish a data-transfer rate that is agreeable to both.

  • TCP/IP Transport Layer
  • Session establishment, maintenance, and termination

Applications can send data segments on a first-come, first-served basis. The segments that arrive first will be taken care of first. These segments can be routed to the same or different destinations. Multiple applications can share the same transport connection in the OSI reference model. This is referred to as the multiplexing of upper-layer conversations. Numerous simultaneous upper-layer conversations can be multiplexed over a single connection.

One function of the transport layer is to establish a connection-oriented session between similar devices at the application layer. For data transfer to begin, the source and destination applications inform the operating systems that a connection will be initiated. One node initiates a connection that must be accepted by the other. Protocol software modules in the two operating systems exchange messages across the network to verify that the transfer is authorized and that both sides are ready.

The connection is established and the transfer of data begins after all synchronization has occurred. The two machines continue to communicate through their protocol software to verify that the data is received correctly.

The first handshake requests synchronization.The second handshake acknowledge the initial synchronization request, as well as synchronizing connection parameters in the opposite direction. The third handshake segment is an acknowledgment used to inform the destination that both sides agree that a connection has been established. After the connection has been established, data transfer begins.

Congestion can occur for two reasons:

First, a high-speed computer might generate traffic faster than a network can transfer it.

Second, if many computers simultaneously need to send datagrams to a single destination, that destination can experience congestion, although no single source caused the problem.

When datagrams arrive too quickly for a host or gateway to process, they are temporarily stored in memory. If the traffic continues, the host or gateway eventually exhausts its memory and must discard additional datagrams that arrive.

Instead of allowing data to be lost, the TCP process on the receiving host can issue a “not ready” indicator to the sender. This indicator signals the sender to stop data transmission. When the receiver can handle additional data, it sends a “ready” transport indicator. When this indicator is received, the sender can resume the segment transmission.

At the end of data transfer, the source host sends a signal that indicates the end of the transmission. The destination host acknowledges the end of transmission and the connection is terminated.

6.1.2 Three-way handshake

TCP is a connection-oriented protocol. TCP requires a connection to be established before data transfer begins. The two hosts must synchronize their initial sequence numbers to establish a connection. Synchronization occurs through an exchange of

segments that carry a synchronize (SYN) control bit and the initial sequence numbers. This solution requires a mechanism that picks the initial sequence numbers and a handshake to exchange them.

The synchronization requires each side to send its own initial sequence number (INS) and to receive a confirmation of exchange in an acknowledgment (ACK) from the other side. Each side must also receive the ISN from the other side and send a confirming ACK. The sequence is as follows:

The sending host (A) initiates a connection by sending a SYN packet to the receiving host (B) indicating its INS = X:

A - > B SYN, seq of A = X

B receives the packet, records that the seq of A = X, replies with an ACK of X + 1, and indicates that its INS = Y. The ACK of X + 1 means that host B has received all octets up to and including X and is expecting X + 1 next:

B - > A ACK, seq of A = X, SYN seq of B = Y, ACK = X + 1

A receives the packet from B, it knows that the seq of B = Y, and responds with an ACK of Y + 1, which finalizes the connection process:

A - > B ACK, seq of B = Y, ACK = Y + 1

This exchange is called the three-way handshake.

A three-way handshake is necessary because sequence numbers are not based on a global clock in the network and TCP protocols may use different mechanisms to choose the initial sequence numbers. The receiver of the first SYN would not know if the segment was delayed unless it kept track of the last sequence number used on the connection. If the receiver does not have this information, it must ask the sender to verify the SYN.

6.1.3 Windowing

Data packets must be delivered to the recipient in the same order in which they were transmitted to have a reliable, connection-oriented data transfer. The protocol fails if any data packets are lost, damaged, duplicated, or received in a different order. An easy solution is to have a recipient acknowledge the receipt of each packet before the next packet is sent.If a sender had to wait for an ACK after each packet was sent, throughput would be low. Therefore, most connection-oriented, reliable protocols allow multiple packets to be sent before an ACK is received. The time interval after the sender transmits a data packet and before the sender processes any ACKs is used to transmit more data. The number of data packets the sender can transmit before it receives an ACK is known as the window size, or window.TCP uses expectational ACKs. This means that the ACK number refers to the next packet that is expected.

Windowing refers to the fact that the window size is negotiated dynamically in the TCP session. Windowing is a flow-control mechanism. Windowing requires the source device to receive an ACK from the destination after a certain amount of data is transmitted. The destination host reports a window size to the source host. This window specifies the number of packets that the destination host is prepared to receive. The first packet is the ACK.With a window size of three, the source device can send three bytes to the destination. The source device must then wait for an ACK. If the destination receives the three bytes, it sends an acknowledgment to the source device, which can now transmit three more bytes.If the destination does not receive the three bytes, because of overflowing buffers, it does not send an acknowledgment. Because the source does not receive an acknowledgment, it knows that the bytes should be retransmitted, and that the transmission rate should be decreased.

In Figure , the sender sends three packets before it expects an ACK. If the receiver can handle only two packets, the window drops packet three, specifies three as the next packet, and indicates a new window size of two. The sender sends the next two packets, but still specifies a window size of three. This means that the sender will still expect a three-packet ACK from the receiver. The receiver replies with a request for packet five and again specifies a window size of two.

6.1.4 TCP

TCP is a connection-oriented transport layer protocol that provides reliable full-duplex data transmission. TCP is part of the TCP/IP protocol stack. In a connection-oriented environment, a connection is established between both ends before the transfer of information can begin. TCP breaks messages into segments, reassembles them at the destination, and resends anything that is not received. TCP supplies a virtual circuit between end-user applications.

The following protocols use TCP:

  • FTP
  • HTTP
  • SMTP
  • Telnet

The following are the definitions of the fields in the TCP segment:

  • Source port – Number of the port that sends data
  • Destination port – Number of the port that receives data
  • Sequence number – Number used to ensure the data arrives in the correct order
  • Acknowledgment number – Next expected TCP octet
  • HLEN – Number of 32-bit words in the header
  • Reserved – Set to zero
  • Code bits – Control functions, such as setup and termination of a session
  • Window – Number of octets that the sender will accept
  • Checksum – Calculated checksum of the header and data fields
  • Urgent pointer – Indicates the end of the urgent data
  • Option – One option currently defined, maximum TCP segment size
  • Data – Upper-layer protocol data

6.1.5 UDP

UDP is a simple protocol that exchanges datagrams without guaranteed delivery. It relies on higher-layer protocols to handle errors and retransmit data.

UDP does not use windows or ACKs. Reliability is provided by application layer protocols. UDP is designed for applications that do not need to put sequences of segments together.

The following protocols use UDP:

  • TFTP
  • SNMP
  • DHCP
  • DNS

The following are the definitions of the fields in the UDP segment:

  • Source port – Number of the port that sends data
  • Destination port – Number of the port that receives data
  • Length – Number of bytes in header and data
  • Checksum – Calculated checksum of the header and data fields
  • Data – Upper-layer protocol data

6.2 The Application Layer

6.2.1 Introduction

The session, presentation, and application layers of the OSI model are bundled into the application layer of the TCP/IP model. This means that representation, encoding, and dialog control are all handled in the TCP/IP application layer. This design ensures that the TCP/IP model provides maximum flexibility at the application layer for software developers.

The TCP/IP protocols that support file transfer, e-mail, and remote login are probably the most familiar to users of the Internet. These protocols include the following applications:

  • DNS
  • FTP
  • HTTP
  • SMTP
  • SNMP
  • Telnet

6.2.2 DNS

The Internet is built on a hierarchical addressing scheme. This scheme allows for routing to be based on classes of addresses rather than based on individual addresses. The problem this creates for the user is associating the correct address with the Internet site. It is very easy to forget an IP address to a particular site because there is nothing to associate the contents of the site with the address. Imagine the difficulty of remembering the IP addresses of tens, hundreds, or even thousands of Internet sites.

A domain naming system was developed in order to associate the contents of the site with the address of that site. The Domain Name System (DNS) is a system used on the Internet for translating names of domains and their publicly advertised network nodes into IP addresses. A domain is a group of computers that are associated by their geographical location or their business type. A domain name is a string of characters, number, or both. Usually a name or abbreviation that represents the numeric address of an Internet site will make up the domain name. There are more than 200 top-level domains on the Internet, examples of which include the following:

.us – United States

.uk – United Kingdom

There are also generic names, which examples include the following:

.edu – educational sites

.com – commercial sites

.gov – government sites

.org – non-profit sites

.net – network service

6.2.2 FTP and TFTP

FTP is a reliable, connection-oriented service that uses TCP to transfer files between systems that support FTP. The main purpose of FTP is to transfer files from one computer to another by copying and moving files from servers to clients, and from clients to servers. When files are copied from a server, FTP first establishes a control connection between the client and the server. Then a second connection is established, which is a link between the computers through which the data is transferred. Data transfer can occur in ASCII mode or in binary mode. These modes determine the encoding used for data file, which in the OSI model is a presentation layer task. After the file transfer has ended, the data connection terminates automatically. When the entire session of copying and moving files is complete, the command link is closed when the user logs off and ends the session.

TFTP is a connectionless service that uses User Datagram Protocol (UDP). TFTP is used on the router to transfer configuration files and Cisco IOS images and to transfer files between systems that support TFTP. TFTP is designed to be small and easy to implement. Therefore, it lacks most of the features of FTP. TFTP can read or write files to or from a remote server but it cannot list directories and currently has no provisions for user authentication. It is useful in some LANs because it operates faster than FTP and in a stable environment it works reliably.

6.2.4 HTTP

Hypertext Transfer Protocol (HTTP) works with the World Wide Web, which is the fastest growing and most used part of the Internet. One of the main reasons for the extraordinary growth of the Web is the ease with which it allows access to information. A Web browser is a client-server application, which means that it requires both a client and a server component in order to function. A Web browser presents data in multimedia formats on Web pages that use text, graphics, sound, and video. The Web pages are created with a format language called Hypertext Markup Language (HTML). HTML directs a Web browser on a particular Web page to produce the appearance of the page in a specific manner. In addition, HTML specifies locations for the placement of text, files, and objects that are to be transferred from the Web server to the Web browser.

Hyperlinks make the World Wide Web easy to navigate. A hyperlink is an object, word, phrase, or picture, on a Web page. When that hyperlink is clicked, it directs the browser to a new Web page. The Web page contains, often hidden within its HTML description, an address location known as a Uniform Resource Locator (URL).

In the URL http://www.cisco.com/edu/, the "http://" tells the browser which protocol to use. The second part, "www", is the hostname or name of a specific machine with a specific IP address. The last part, /edu/ identifies the specific folder location on the server that contains the default web page.

A Web browser usually opens to a starting or "home" page. The URL of the home page has already been stored in the configuration area of the Web browser and can be changed at any time. From the starting page, click on one of the Web page hyperlinks, or type a URL in the address bar of the browser. The Web browser examines the protocol to determine if it needs to open another program, and then determines the IP address of the Web server using DNS. Then the transport layer, network layer, data link layer, and physical layer work together to initiate a session with the Web server. The data that is transferred to the HTTP server contains the folder name of the Web page location. The data can also contain a specific file name for an HTML page. If no name is given, then the default name as specified in the configuration on the server is used.

The server responds to the request by sending to the Web client all of the text, audio, video, and graphic files specified in the HTML instructions. The client browser reassembles all the files to create a view of the Web page, and then terminates the session. If another page that is located on the same or a different server is clicked, the whole process begins again.

6.2.5 SMTP

Email servers communicate with each other using the Simple Mail Transfer Protocol (SMTP) to send and receive mail. The SMTP protocol transports email messages in ASCII format using TCP.

When a mail server receives a message destined for a local client, it stores that message and waits for the client to collect the mail. There are several ways for mail clients to collect their mail. They can use programs that access the mail server files directly or collect their mail using one of many network protocols. The most popular mail client protocols are POP3 and IMAP4, which both use TCP to transport data. Even though mail clients use these special protocols to collect mail, they almost always use SMTP to send mail. Since two different protocols, and possibly two different servers, are used to send and receive mail, it is possible that mail clients can perform one task and not the other. Therefore, it is usually a good idea to troubleshoot e-mail sending problems separately from e-mail receiving problems.

When checking the configuration of a mail client, verify that the SMTP and POP or IMAP settings are correctly configured. A good way to test if a mail server is reachable is to Telnet to the SMTP port (25) or to the POP3 port (110). The following command format is used at the Windows command line to test the ability to reach the SMTP service on the mail server at IP address 192.168.10.5:

C:\>telnet 192.168.10.5 25

The SMTP protocol does not offer much in the way of security and does not require any authentication. Administrators often do not allow hosts that are not part of their network to use their SMTP server to send or relay mail. This is to prevent unauthorized users from using their servers as mail relays.

6.2.6 SNMP

The Simple Network Management Protocol (SNMP) is an application layer protocol that facilitates the exchange of management information between network devices. SNMP enables network administrators to manage network performance, find and solve network problems, and plan for network growth. SNMP uses UDP as its transport layer protocol.

An SNMP managed network consists of the following three key components:

  • Network management system (NMS) – NMS executes applications that monitor and control managed devices. The bulk of the processing and memory resources required for network management are provided by NMS. One or more NMSs must exist on any managed network.
  • Managed devices – Managed devices are network nodes that contain an SNMP agent and that reside on a managed network. Managed devices collect and store management information and make this information available to NMSs using SNMP. Managed devices, sometimes called network elements, can be routers, access servers, switches, and bridges, hubs, computer hosts, or printers.
  • Agents – Agents are network-management software modules that reside in managed devices. An agent has local knowledge of management information and translates that information into a form compatible with SNMP.

6.2.7 Telnet

Telnet client software provides the ability to login to a remote Internet host that is running a Telnet server application and then to execute commands from the command line. A Telnet client is referred to as a local host. Telnet server, which uses special software called a daemon, is referred to as a remote host.

To make a connection from a Telnet client, the connection option must be selected. A dialog box typically prompts for a host name and terminal type. The host name is the IP address or DNS name of the remote computer. The terminal type describes the type of terminal emulation that the Telnet client should perform. The Telnet operation uses none of the processing power from the transmitting computer. Instead, it transmits the keystrokes to the remote host and sends the resulting screen output back to the local monitor. All processing and storage take place on the remote computer.

Telnet works at the application layer of the TCP/IP model. Therefore, Telnet works at the top three layers of the OSI model. The application layer deals with commands. The presentation layer handles formatting, usually ASCII. The session layer transmits. In the TCP/IP model, all of these functions are considered to be part of the application layer.

OSI REFERENCE MODEL


5. OSI REFERENCE MODEL

5.1 Introduction

The early development of networks was disorganized in many ways. The early 1980s saw tremendous increases in the number and size of networks. As companies realized the advantages of using networking technology, networks were added or expanded almost as rapidly as new network technologies were introduced.

By the mid-1980s, these companies began to experience problems from the rapid expansion. Just as people who do not speak the same language have difficulty communicating with each other, it was difficult for networks that used different specifications and implementations to exchange information. The same problem occurred with the companies that developed private or proprietary networking technologies. Proprietary means that one or a small group of companies controls all usage of the technology. Networking technologies strictly following proprietary rules could not communicate with technologies that followed different proprietary rules.

To address the problem of network incompatibility, the International Organization for Standardization (ISO) researched networking models like Digital Equipment Corporation net (DECnet), Systems Network Architecture (SNA), and TCP/IP in order to find a generally applicable set of rules for all networks. Using this research, the ISO created a network model that helps vendors create networks that are compatible with other n/w

The OSI reference model released in 1984 was the descriptive network model that the ISO created. It provided vendors with a set of standards that ensured greater compatibility and interoperability among various network technologies produced by companies around the world.
The OSI reference model has become the primary model for network communications. Although there are other models in existence, most network vendors relate their products to the OSI reference model. This is especially true when they want to educate users on the use of their products. It is considered the best tool available for teaching people about sending and receiving data on a network.

The OSI reference model is a framework that is used to understand how information travels throughout a network. The OSI reference model explains how packets travel through the various layers to another device on a network, even if the sender and destination have different types of network media. In the OSI reference model, there are seven numbered layers, each of which illustrates a particular network function.Dividing the network into seven layers provides the following advantages:

  • It breaks network communication into smaller, more manageable parts.
  • It standardizes network components to allow multiple vendor development and support.
  • It allows different types of network hardware and software to communicate with each other.
  • It prevents changes in one layer from affecting other layers.
  • It divides network communication into smaller parts to make learning it easier to understand.

5.2 OSI Layers

Layer 7:Application Layer

  • Defines interface-to-user processes for communication and data transfer in network
  • Provides standardized services such as virtual terminal, file and job transfer and operations

Layer 6: Presentation Layer

  • Masks the differences of data formats between dissimilar systems
  • Specifies architecture-independent data transfer format
  • Encodes and decodes data; encrypts and decrypts data; compresses and decompresses data

Layer 5: Session Layer

  • Manages user sessions and dialogues
  • Controls establishment and termination of logic links between users
  • Reports upper layer errors

Layer 4: Transport Layer

  • Manages end-to-end message delivery in network
  • Provides reliable and sequential packet delivery through error recovery and flow control mechanisms
  • Provides connectionless oriented packet delivery

Layer 3: Network Layer

  • Determines how data are transferred between network devices
  • Routes packets according to unique network device addresses
  • Provides flow and congestion control to prevent network resource depletion

Layer 2: Data Link Layer

  • Defines procedures for operating the communication links
  • Frames packets
  • Detects and corrects packets transmit errors

Layer 1: Physical Layer

  • Defines physical means of sending data over network devices
  • Interfaces between network medium and devices
Defines optical, electrical and mechanical characteristics

IP ADDRESSING & SUBNETTING

4. IP ADDRESSING & SUBNETTING

4.1 IP Addressing

For any two systems to communicate, they must be able to identify and locate each other.A computer may be connected to more than one network.
In this situation, the system must be given more than one address.Each address will identify the connection of the computer to a different network. Each connection point, or interface, on a device has an address to a network. This will allow other computers to locate the device on that particular network. The combination of the network address and the host address creates a unique address for each device on a network.Each computer in a TCP/IP network must be given a unique identifier, or IP address. This address, which operates at Layer 3, allows one computer to locate another computer on a network. All computers also have a unique physical address, which is known as a MAC address. These are assigned by the manufacturer of the NIC. MAC addresses operate at Layer 2 of the OSI model.

An IP address is a 32-bit sequence of ones and zeros.

Figure shows a sample 32-bit number.

1000001101101100011110101101100

To make the IP address easier to work with, it is usually written as four decimal numbers separated by periods.For example, an IP address of one computer is 192.168.1.2. Another computer might have the address 128.10.2.1. This is called the dotted decimal format. Each part of the address is called an octet because it is made up of eight binary digits.

Eg,the IP address 192.168.1.8 would be 11000000.10101000.00000001.00001000 in binary notation. The dotted decimal notation is an easier method to understand than the binary ones and zeros method. This dotted decimal notation also prevents a large number of transposition errors that would result if only the binary numbers were used.

However, the address is easier to understand in dotted decimal notation. This is one of the common problems associated with binary numbers. The long strings of repeated ones and zeros make errors more likely.

IPv4 addressing

A router uses IP to forward packets from the source network to the destination network. The packets must include an identifier for both the source and destination networks.
A router uses the IP address of the destination network to deliver a packet to the correct network. When the packet arrives at a router connected to the destination network, the router uses the IP address to locate the specific computer on the network. This system works in much the same way as the national postal system. When the mail is routed, the zip code is used to deliver it to the post office at the destination city. That post office must use the street address to locate the final destination in the city.Every IP address also has two parts.The first part identifies the network where the system is connected and the second part identifies the system. Each octet ranges from 0 to 255. Each one of the octets breaks down into 256 subgroups and they break down into another 256 subgroups with 256 addresses in each. By referring to the group address directly above a group in the hierarchy, all of the groups that branch from that address can be referenced as a single unit.

This kind of address is called a hierarchical address, because it contains different levels. An IP address combines these two identifiers into one number. This number must be a unique number, because duplicate addresses would make routing impossible. The first part identifies the system's network address. The second part, called the host part, identifies which particular machine it is on the network.

IP addresses are divided into classes to define the large, medium, and small networks. Class A addresses are assigned to larger networks. Class B addresses are used for medium-sized networks, and Class C for small networks.The first step in determining which part of the address identifies the network and which part identifies the host is identifying the class of an IP address.

Class A, B, C, D, and E IP addresses

To accommodate different size networks and aid in classifying these networks, IP addresses are divided into groups called classes.This is known as classful addressing. Each complete 32-bit IP address is broken down into a network part and a host part.
A bit or bit sequence at the start of each address determines the class of the address.

The Class A address was designed to support extremely large networks, with more than 16 million host addresses available.Class A IP addresses use only the first octet to indicate the network address. The remaining three octets provide for host addresses.

The first bit of a Class A address is always 0. With that first bit a 0, the lowest number that can be represented is 00000000, decimal 0. The highest number that can be represented is 01111111, decimal 127. The numbers 0 and 127 are reserved and cannot be used as network addresses. Any address that starts with a value between 1 and 126 in the first octet is a Class A address.

The 127.0.0.0 network is reserved for loopback testing. Routers or local machines can use this address to send packets back to themselves. Therefore, this number cannot be assigned to a network.

The Class B address was designed to support the needs of moderate to large-sized networks.
A Class B IP address uses the first two of the four octets to indicate the network address. The other two octets specify host addresses.

The first two bits of the first octet of a Class B address are always 10. The remaining six bits may be populated with either 1s or 0s. Therefore, the lowest number that can be represented with a Class B address is 10000000, decimal 128. The highest number that can be represented is 10111111, decimal 191. Any address that starts with a value in the range of 128 to 191 in the first octet is a Class B address.

The Class C address space is the most commonly used of the original address classes.
This address space was intended to support small networks with a maximum of 254 hosts.

A Class C address begins with binary 110. Therefore, the lowest number that can be represented is 11000000, decimal 192. The highest number that can be represented is 11011111, decimal 223. If an address contains a number in the range of 192 to 223 in the first octet, it is a Class C address.

The Class D address class was created to enable multicasting in an IP address.
A multicast address is a unique network address that directs packets with that destination address to predefined groups of IP addresses. Therefore, a single station can simultaneously transmit a single stream of data to multiple recipients.

The Class D address space, much like the other address spaces, is mathematically constrained. The first four bits of a Class D address must be 1110. Therefore, the first octet range for Class D addresses is 11100000 to 11101111, or 224 to 239. An IP address that starts with a value in the range of 224 to 239 in the first octet is a Class D address.

A Class E address has been defined.However, the Internet Engineering Task Force (IETF) reserves these addresses for its own research. Therefore, no Class E addresses have been released for use in the Internet. The first four bits of a Class E address are always set to 1s. Therefore, the first octet range for Class E addresses is 11110000 to 11111111, or 240 to 255.

Reserved IP addresses

Certain host addresses are reserved and cannot be assigned to devices on a network. These reserved host addresses include the following:

  • Network address – Used to identify the network itself

In Figure,the section that is identified by the upper box represents the 198.150.11.0 network. Data that is sent to any host on that network (198.150.11.1- 198.150.11.254) will be seen outside of the local area network as 198.159.11.0. The only time that the host numbers matter is when the data is on the local area network. The LAN that is contained in the lower box is treated the same as the upper LAN, except that its network number is 198.150.12.0.

  • Broadcast address – Used for broadcasting packets to all the devices on a network

In Figure,the section that is identified by the upper box represents the 198.150.11.255 broadcast address. Data that is sent to the broadcast address will be read by all hosts on that network (198.150.11.1- 198.150.11.254). The LAN that is contained in the lower box is treated the same as the upper LAN, except that its broadcast address is 198.150.12.255.

An IP address that has binary 0s in all host bit positions is reserved for the network address. In a Class A network example, 113.0.0.0 is the IP address of the network, known as the network ID, containing the host 113.1.2.3. A router uses the network IP address when it forwards data on the Internet.

In a Class B network address, the first two octets are designated as the network portion. The last two octets contain 0s because those 16 bits are for host numbers and are used to identify devices that are attached to the network. The IP address, 176.10.0.0, is an example of a network address. This address is never assigned as a host address. A host address for a device on the 176.10.0.0 network might be 176.10.16.1.

To send data to all the devices on a network, a broadcast address is needed.
A broadcast occurs when a source sends data to all devices on a network. To ensure that all the other devices on the network process the broadcast, the sender must use a destination IP address that they can recognize and process. Broadcast IP addresses end with binary 1s in the entire host part of the address.

In the network example, 176.10.0.0, the last 16 bits make up the host field or host part of the address.
The broadcast that would be sent out to all devices on that network would include a destination address of 176.10.255.255. This is because 255 is the decimal value of an octet containing 11111111.

Public and private IP addresses

The stability of the Internet depends directly on the uniqueness of publicly used network addresses.
There is an issue with the network addressing scheme. In looking at the networks, both have a network address of 198.150.11.0. The router in this illustration will not be able to forward the data packets correctly. Duplicate network IP addresses prevent the router from performing its job of best path selection. Unique addresses are required for each device on a network.

A procedure was needed to make sure that addresses were in fact unique. Originally, an organization known as the Internet Network Information Center (InterNIC) handled this procedure. InterNIC no longer exists and has been succeeded by the Internet Assigned Numbers Authority (IANA). IANA carefully manages the remaining supply of IP addresses to ensure that duplication of publicly used addresses does not occur. Duplication would cause instability in the Internet and compromise its ability to deliver datagrams to networks.

Public IP addresses are unique. No two machines that connect to a public network can have the same IP address because public IP addresses are global and standardized. All machines connected to the Internet agree to conform to the system. Public IP addresses must be obtained from an Internet service provider (ISP) or a registry at some expense.

With the rapid growth of the Internet, public IP addresses were beginning to run out. New addressing schemes, such as classless interdomain routing (CIDR) and IPv6 were developed to help solve the problem. CIDR and IPv6 are discussed later in the course.

Private IP addresses are another solution to the problem of the impending exhaustion of public IP addresses. As mentioned, public networks require hosts to have unique IP addresses. However, private networks that are not connected to the Internet may use any host addresses, as long as each host within the private network is unique. Many private networks exist alongside public networks. However, a private network using just any address is strongly discouraged because that network might eventually be connected to the Internet. RFC 1918 sets aside three blocks of IP addresses for private, internal use.
These three blocks consist of one Class A, a range of Class B addresses, and a range of Class C addresses. Addresses that fall within these ranges are not routed on the Internet backbone. Internet routers immediately discard private addresses. If addressing a nonpublic intranet, a test lab, or a home network, these private addresses can be used instead of globally unique addresses.
Private IP addresses can be intermixed, as shown in the graphic, with public IP addresses. This will conserve the number of addresses used for internal connections.

Connecting a network using private addresses to the Internet requires translation of the private addresses to public addresses. This translation process is referred to as Network Address Translation (NAT). A router usually is the device that performs NAT. NAT, along with CIDR and IPv6 are covered in more depth later in the curriculum.

4.2 Subnetting

Subnetting is one method used to manage IP addresses, as shown in example
, the 131.108.0.0 network is subnetted into the 131.108.1.0, 131.108.2.0 and 131.108.3.0 subnets. This method of dividing full network address classes into smaller pieces has prevented complete IP address exhaustion. It is impossible to cover TCP/IP without mentioning subnetting. As a system administrator it is important to understand subnetting as a means of dividing and identifying separate networks throughout the LAN. It is not always necessary to subnet a small network. However, for large or extremely large networks,subnetting is required.Subnetting a network means to use the subnet mask to divide the network and break a large network up into smaller, more efficient and manageable segments, or subnets. An example would be the U.S. telephone system which is broken into area codes, exchange codes, and local numbers.

The system administrator must resolve these issues when adding and expanding the network. It is important to know how many subnets or networks are needed and how many hosts will be needed on each network. With subnetting, the network is not limited to the default Class A, B, or C network masks and there is more flexibility in the network design.

Subnet addresses include the network portion, plus a subnet field and a host field. The subnet field and the host field are created from the original host portion for the entire network. The ability to decide how to divide the original host portion into the new subnet and host fields provides addressing flexibility for the network administrator.

To create a subnet address, a network administrator borrows bits from the host field and designates them as the subnet field.The minimum number of bits that can be borrowed is two. When creating a subnet, where only one bit was borrowed the network number would be the .0 network. The broadcast number would then be the .255 network. The maximum number of bits that can be borrowed can be any number that leaves at least two bits remaining, for the host number.

Static assignment of an IP address

Static assignment works best on small, infrequently changing networks. The system administrator manually assigns and tracks IP addresses for each computer, printer, or server on the intranet.Good recordkeeping is critical to prevent problems which occur with duplicate IP addresses. This is possible only when there are a small number of devices to track. Servers should be assigned a static IP address so workstations and other devices will always know how to access needed services.Consider how difficult it would be to phone a business that changed its phone number every day.

Other devices that should be assigned static IP addresses are network printers, application servers, and routers.

RARP IP address assignment

Reverse Address Resolution Protocol (RARP) associates a known MAC addresses with an IP addresses. This association allows network devices to encapsulate data before sending the data out on the network. A network device, such as a diskless workstation, might know its MAC address but not its IP address. RARP allows the device to make a request to learn its IP address. Devices using RARP require that a RARP server be present on the network to answer RARP requests.

Consider an example where a source device wants to send data to another device. In this example, the source device knows its own MAC address but is unable to locate its own IP address in the ARP table. The source device must include both its MAC address and IP address in order for the destination device to retrieve data, pass it to higher layers of the OSI model, and respond to the originating device. Therefore, the source initiates a process called a RARP request. This request helps the source device detect its own IP address. RARP requests are broadcast onto the LAN and are responded to by the RARP server which is usually a router. RARP uses the same packet format as ARP. However, in a RARP request, the MAC headers and operation code are different from an ARP request.

BOOTP IP address assignment

The bootstrap protocol (BOOTP) operates in a client-server environment and only requires a single packet exchange to obtain IP information. However, unlike RARP, BOOTP packets can include the IP address, as well as the address of a router, the address of a server, and vendor-specific information.

One problem with BOOTP, however, is that it was not designed to provide dynamic address assignment. With BOOTP, a network administrator creates a configuration file that specifies the parameters for each device. The administrator must add hosts and maintain the BOOTP database. Even though the addresses are dynamically assigned, there is still a one to one relationship between the number of IP addresses and the number of hosts. This means that for every host on the network there must be a BOOTP profile with an IP address assignment in it. No two profiles can have the same IP address. Those profiles might be used at the same time and that would mean that two hosts have the same IP address.

A device uses BOOTP to obtain an IP address when starting up. BOOTP uses UDP to carry messages. The UDP message is encapsulated in an IP packet. A computer uses BOOTP to send a broadcast IP packet using a destination IP address of all 1s, 255.255.255.255 in dotted decimal notation. A BOOTP server receives the broadcast and then sends back a broadcast. The client receives a frame and checks the MAC address. If the client finds its own MAC address in the destination address field and a broadcast in the IP destination field, it takes and stores the IP address and other information supplied in the BOOTP reply message. A step-by-step description of the process

DHCP IP address management

Dynamic host configuration protocol (DHCP) is the successor to BOOTP. Unlike BOOTP, DHCP allows a host to obtain an IP address dynamically without the network administrator having to set up an individual profile for each device. All that is required when using DHCP is a defined range of IP addresses on a DHCP server. As hosts come online, they contact the DHCP server and request an address.

The DHCP server chooses an address and leases it to that host. With DHCP, the entire network configuration of a computer can be obtained in one message. The major advantage that DHCP has over BOOTP is that it allows users to be mobile. This mobility allows the users to freely change network connections from location to location.

Problems in address resolution

One of the major problems in networking is how to communicate with other network devices. In TCP/IP communications, a datagram on a local-area network must contain both a destination MAC address and a destination IP address. These addresses must be correct and match the destination MAC and IP addresses of the host device. If it does not match, the datagram will be discarded by the destination host. Communications within a LAN segment require two addresses. There needs to be a way to automatically map IP to MAC addresses. It would be too time consuming for the user to create the maps manually. The TCP/IP suite has a protocol, called Address Resolution Protocol (ARP), which can automatically obtain MAC addresses for local transmission. Different issues are raised when data is sent outside of the local area network.

Communications between two LAN segments have an additional task. Both the IP and MAC addresses are needed for both the destination host and the intermediate routing device. TCP/IP has a variation on ARP called Proxy ARP that will provide the MAC address of an intermediate device for transmission outside the LAN to another network segment.

Address Resolution Protocol (ARP)

Some devices will keep tables that contain MAC addresses and IP addresses of other devices that are connected to the same LAN.
These are called Address Resolution Protocol (ARP) tables. ARP tables are stored in RAM memory, where the cached information is maintained automatically on each of the devices. It is very unusual for a user to have to make an ARP table entry manually. Each device on a network maintains its own ARP table. When a network device wants to send data across the network, it uses information provided by the ARP table.

When a source determines the IP address for a destination, it then consults the ARP table in order to locate the MAC address for the destination. If the source locates an entry in its table, destination IP address to destination MAC address, it will associate the IP address to the MAC address and then uses it to encapsulate the data. The data packet is then sent out over the networking media to be picked up by the destination device.

There are two ways that devices can gather MAC addresses that they need to add to the encapsulated data. One way is to monitor the traffic that occurs on the local network segment.
All stations on an Ethernet network will analyze all traffic to determine if the data is for them. Part of this process is to record the source IP and MAC address of the datagram to an ARP table. So as data is transmitted on the network, the address pairs populate the ARP table. Another way to get an address pair for data transmission is to broadcast an ARP request.
The computer that requires an IP and MAC address pair broadcasts an ARP request. All the other devices on the local area network analyze this request. If one of the local devices matches the IP address of the request, it sends back an ARP reply that contains its IP-MAC pair. If the IP address is for the local area network and the computer does not exist or is turned off, there is no response to the ARP request. In this situation, the source device reports an error. If the request is for a different IP network, there is another process that can be used.

Routers do not forward broadcast packets. If the feature is turned on, a router performs a proxy ARP.Proxy ARP is a variation of the ARP protocol. In this variation, a router sends an ARP response with the MAC address of the interface on which the request was received, to the requesting host. The router responds with the MAC addresses for those requests in which the IP address is not in the range of addresses of the local subnet.

Another method to send data to the address of a device that is on another network segment is to set up a default gateway.The default gateway is a host option where the IP address of the router interface is stored in the network configuration of the host. The source host compares the destination IP address and its own IP address to determine if the two IP addresses are located on the same segment. If the receiving host is not on the same segment, the source host sends the data using the actual IP address of the destination and the MAC address of the router. The MAC address for the router was learned from the ARP table by using the IP address of that router. If the default gateway on the host or the proxy ARP feature on the router is not configured, no traffic can leave the local area network. One or the other is required to have a connection outside of the local area network.

ETHERNET

3.ETHERNET

3.1 Ethernet fundamentals

Ethernet is now the dominant LAN technology in the world. Ethernet is a family of LAN technologies that may be best understood with the OSI reference model. All LANs must deal with the basic issue of how individual stations, or nodes, are named. Ethernet specifications support different media, bandwidths, and other Layer 1 and 2 variations. However, the basic frame format and address scheme is the same for all varieties of Ethernet.

The success of Ethernet is due to the following factors:

  • Simplicity and ease of maintenance
  • Ability to incorporate new technologies
  • Reliability
  • Low cost of installation and upgrade

The introduction of Gigabit Ethernet has extended the original LAN technology to distances that make Ethernet a MAN and WAN standard.

The original idea for Ethernet was to allow two or more hosts to use the same medium with no interference between the signals. This problem of multiple user access to a shared medium was studied in the early 1970s at the University of Hawaii..

3.2 IEEE Ethernet:Naming Rules

Ethernet is not one networking technology, but a family of networking technologies that includes Legacy, Fast Ethernet, and Gigabit Ethernet. Ethernet speeds can be 10, 100, 1000, or 10,000 Mbps. The basic frame format and the IEEE sublayers of OSI Layers 1 and 2 remain consistent across all forms of Ethernet.

When Ethernet needs to be expanded to add a new medium or capability, the IEEE issues a new supplement to the 802.3 standard. The new supplements are given a one or two letter designation such as 802.3u. An abbreviated description, called an identifier, is also assigned to the supplement.

The abbreviated description consists of the following elements:

A number that indicates the number of Mbps transmitted

The word base to indicate that baseband signaling is used

One or more letters of the alphabet indicating the type of medium used. For example, F = fiber optical cable and T = copper unshielded twisted pair

Ethernet relies on baseband signaling, which uses the entire bandwidth of the transmission medium. The data signal is transmitted directly over the transmission medium.

In broadband signaling, the data signal is no longer placed directly on the transmission medium. Ethernet used broadband signaling in the 10BROAD36 standard. 10BROAD36 is the IEEE standard for an 802.3 Ethernet network using broadband transmission with thick coaxial cable running at 10 Mbps. 10BROAD36 is now considered obsolete. An analog or carrier signal is modulated by the data signal and then transmitted. Radio broadcasts and cable TV use broadband signaling.

3.3 Ethernet and OSI model

Ethernet operates in two areas of the OSI model. These are the lower half of the data link layer, which is known as the MAC sublayer, and the physical layer.

Data that moves from one Ethernet station to another often passes through a repeater. All stations in the same collision domain see traffic that passes through a repeater.

A collision domain is a shared resource. Problems that originate in one part of a collision domain will usually impact the entire collision domain.

A repeater forwards traffic to all other ports. A repeater never sends traffic out the same port from which it was received. Any signal detected by a repeater will be forwarded. If the signal is degraded through attenuation or noise, the repeater will attempt to reconstruct and regenerate the signal.

To guarantee minimum bandwidth and operability, standards specify the maximum number of stations per segment, maximum segment length, and maximum number of repeaters between stations. Stations separated by bridges or routers are in different collision domains.

Data link sublayers contribute significantly to technological compatibility and computer communications. The MAC sublayer is concerned with the physical components that will be used to communicate the information. The Logical Link Control (LLC) sublayer remains relatively independent of the physical equipment that will be used for the communication process.

3.4 Naming

An address system is required to uniquely identify computers and interfaces to allow for local delivery of frames on the Ethernet.

Ethernet uses MAC addresses that are 48 bits in length and expressed as 12 hexadecimal digits. The first six hexadecimal digits, which are administered by the IEEE, identify the manufacturer or vendor. This portion of the MAC address is known as the Organizational Unique Identifier (OUI). The remaining six hexadecimal digits represent the interface serial number or another value administered by the manufacturer.

MAC addresses are sometimes referred to as burned-in MAC addresses (BIAs) because they are burned into ROM and are copied into RAM when the NIC initializes.

At the data link layer MAC headers and trailers are added to upper layer data. The header and trailer contain control information intended for the data link layer in the destination system. The data from upper layers is encapsulated within the data link frame, between the header and trailer, and then sent out on the network.

3.5 Layer 2 framing

Framing is the Layer 2 encapsulation process. A frame is the Layer 2 protocol data unit.

There are many different types of frames described by various standards. A single generic frame has sections called fields. Each field is composed of bytes.

The names of the fields are as follows:

Start Frame field

Address field

Length/Type field

Data field

Frame Check Sequence (FCS) field

(Generic frame format)

When computers are connected to a physical medium, there must be a way to inform other computers when they are about to transmit a frame. Various technologies do this in different ways. Regardless of the technology, all frames begin with a sequence of bytes to signal the data transmission.

All frames contain naming information, such as the name of the source node, or source MAC address, and the name of the destination node, or destination MAC address.

Most frames have some specialized fields. In some technologies, a Length field specifies the exact length of a frame in bytes. Some frames have a Type field, which specifies the Layer 3 protocol used by the device that wants to send data.

Frames are used to send upper-layer data and ultimately the user application data from a source to a destination. The data package includes the message to be sent, or user application data. Extra bytes may be added so frames have a minimum length for timing purposes. LLC bytes are also included with the Data field in the IEEE standard frames. The LLC sublayer takes the network protocol data, which is an IP packet, and adds control information to help deliver the packet to the destination node. Layer 2 communicates with the upper layers through LLC.

All frames and the bits, bytes, and fields contained within them, are susceptible to errors from a variety of sources. The FCS field contains a number that is calculated by the source node based on the data in the frame. This number is added to the end of a frame that is sent. When the destination node receives the frame the FCS number is recalculated and compared with the FCS number included in the frame. If the two numbers are different, an error is assumed, the frame is discarded.

Because the source cannot detect that the frame has been discarded, retransmission has to be initiated by higher layer connection-oriented protocols providing data flow control. Because these protocols, such as TCP, expect frame acknowledgment, ACK, to be sent by the peer station within a certain time, retransmission usually occurs.

The node that transmits data must get the attention of other devices to start and end a frame. The Length field indicates where the frame ends. The frame ends after the FCS. Sometimes there is a formal byte sequence referred to as an end-frame delimiter.

3.6 Ethernet Frame Structure

At the data link layer the frame structure is nearly identical for all speeds of Ethernet from 10 Mbps to 10,000 Mbps.

However, at the physical layer almost all versions of Ethernet are very different. Each speed has a distinct set of architecture design rules.

In the version of Ethernet that was developed by DIX prior to the adoption of the IEEE 802.3 version of Ethernet, the Preamble and Start-of-Frame (SOF) Delimiter were combined into a single field. The binary pattern was identical. The field labeled Length/Type was only listed as Length in the early IEEE versions and only as Type in the DIX version. These two uses of the field were officially combined in a later IEEE version since both uses were common.

The Ethernet II Type field is incorporated into the current 802.3 frame definition. When a node receives a frame it must examine the Length/Type field to determine which higher-layer protocol is present. If the two-octet value is equal to or greater than 0x0600 hexadecimal, 1536 decimal, then the contents of the Data Field are decoded according to the protocol indicated.

Ethernet II is the Ethernet frame format that is used in TCP/IP networks.

3.7 Ethernet Frame Fields

Some of the fields permitted or required in an 802.3 Ethernet frame are as follows:

3.8 MAC

MAC refers to protocols that determine which computer in a shared-media environment, or collision domain, is allowed to transmit data. MAC and LLC comprise the IEEE version of the OSI Layer 2. MAC and LLC are sublayers of Layer 2. The two broad categories of MAC are deterministic and non-deterministic.

Examples of deterministic protocols include Token Ring and FDDI. In a Token Ring network, hosts are arranged in a ring and a special data token travels around the ring to each host in sequence. When a host wants to transmit, it seizes the token, transmits the data for a limited time, and then forwards the token to the next host in the ring. Token Ring is a collisionless environment since only one host can transmit at a time.

Non-deterministic MAC protocols use a first-come, first-served approach. Carrier Sense Multiple Access with Collision Detection (CSMA/CD) is a simple system. The NIC

listens for the absence of a signal on the media and begins to transmit. If two nodes transmit at the same time a collision occurs and none of the nodes are able to transmit.

Three common Layer 2 technologies are Token Ring, FDDI, and Ethernet. All three specify Layer 2 issues, LLC, naming, framing, and MAC, as well as Layer 1 signaling components and media issues. The specific technologies for each are as follows:

Ethernet – uses a logical bus topology to control information flow on a linear bus and a physical star or extended star topology for the cables

Token Ring – uses a logical ring topology to control information flow and a physical star topology

FDDI – uses a logical ring topology to control information flow and a physical dual-ring topology

MAC rules and collision detection/backoff -Ethernet is a shared-media broadcast technology.The access method CSMA/CD used in Ethernet performs three functions:

  • Transmitting and receiving data frames

  • Decoding data frames and checking them for valid addresses before passing them to the upper layers of the OSI model

  • Detecting errors within data frames or on the network

(CSMA/CD)

In the CSMA/CD access method, networking devices with data to transmit work in a listen-before-transmit mode. This means when a node wants to send data, it must first check to see whether the networking media is busy. If the node determines the network is busy, the node will wait a random amount of time before retrying. If the node determines the networking media is not busy, the node will begin transmitting and listening. The node listens to ensure no other stations are transmitting at the same time. After completing data transmission the device will return to listening mode.

Networking devices detect a collision has occurred when the amplitude of the signal on the networking media increases. When a collision occurs, each node that is transmitting will continue to transmit for a short time to ensure that all nodes detect the collision. When all nodes have detected the collision, the backoff algorithm is invoked and transmission stops. The nodes stop transmitting for a random period of time, determined by the backoff algorithm. When the delay periods expire, each node can attempt to access the networking media. The devices that were involved in the collision do not have transmission priority.

3.9 Ethernet timing

The basic rules and specifications for proper operation of Ethernet are not particularly complicated, though some of the faster physical layer implementations are becoming so. Despite the basic simplicity, when a problem occurs in Ethernet it is often quite difficult to isolate the source. Because of the common bus architecture of Ethernet, also described as a distributed single point of failure, the scope of the problem usually encompasses all devices within the collision domain. In situations where repeaters are used, this can include devices up to four segments away.

Any station on an Ethernet network wishing to transmit a message first “listens” to ensure that no other station is currently transmitting. If the cable is quiet, the station will begin transmitting immediately. The electrical signal takes time to travel down the cable (delay), and each subsequent repeater introduces a small amount of latency in forwarding the frame from one port to the next. Because of the delay and latency, it is possible for more than one station to begin transmitting at or near the same time. This results in a collision.

If the attached station is operating in full duplex then the station may send and receive simultaneously and collisions should not occur. Full-duplex operation also changes the timing considerations and eliminates the concept of slot time. Full-duplex operation allows for larger network architecture designs since the timing restriction for collision detection is removed.

In half duplex, assuming that a collision does not occur, the sending station will transmit 64 bits of timing synchronization information that is known as the preamble. The sending station will then transmit the following information:

Destination and source MAC addressing information

Certain other header information

The actual data payload

3.10 Error handling

The most common error condition on Ethernet networks are collisions.

Collisions are the mechanism for resolving contention for network access. A few collisions provide a smooth, simple, low overhead way for network nodes to arbitrate contention for the network resource. When network contention becomes too great, collisions can become a significant impediment to useful network operation.

Collisions result in network bandwidth loss that is equal to the initial transmission and the collision jam signal. This is consumption delay and affects all network nodes possibly causing significant reduction in network throughput.

The considerable majority of collisions occur very early in the frame, often before the SFD. Collisions occurring before the SFD are usually not reported to the higher layers, as if the collision did not occur. As soon as a collision is detected, the sending stations transmit a 32-bit “jam” signal that will enforce the collision. This is done so that any data being transmitted is thoroughly corrupted and all stations have a chance to detect the collision.

3.11 Types of collisions

Collisions typically take place when two or more Ethernet stations transmit simultaneously within a collision domain. A single collision is a collision that was detected while trying to transmit a frame, but on the next attempt the frame was transmitted successfully. Multiple collisions indicate that the same frame collided repeatedly before being successfully transmitted. The results of collisions, collision fragments, are partial or corrupted frames that are less than 64 octets and have an invalid FCS. Three types of collisions are:

  • Local
  • Remote
  • Late

To create a local collision on coax cable (10BASE2 and 10BASE5), the signal travels down the cable until it encounters a signal from the other station. The waveforms then overlap, canceling some parts of the signal out and reinforcing or doubling other parts. The doubling of the signal pushes the voltage level of the signal beyond the allowed maximum. This over-voltage condition is then sensed by all of the stations on the local cable segment as a collision.

The characteristics of a remote collision are a frame that is less than the minimum length, has an invalid FCS checksum, but does not exhibit the local collision symptom of over-voltage or simultaneous RX/TX activity. This sort of collision usually results from collisions occurring on the far side of a repeated connection. A repeater will not forward an over-voltage state, and cannot cause a station to have both the TX and RX pairs active at the same time. The station would have to be transmitting to have both pairs active, and that would constitute a local collision. On UTP networks this is the most common sort of collision observed.

There is no possibility remaining for a normal or legal collision after the first 64 octets of data has been transmitted by the sending stations. Collisions occurring after the first 64 octets are called “late collisions". The most significant difference between late collisions and collisions occurring before the first 64 octets is that the Ethernet NIC will retransmit a normally collided frame automatically, but will not automatically retransmit a frame that was collided late.

3.12 Ethernet errors

Knowledge of typical errors is invaluable for understanding both the operation and troubleshooting of Ethernet networks.

The following are the sources of Ethernet error:

Collision or runt – Simultaneous transmission occurring before slot time has elapsed

Late collision – Simultaneous transmission occurring after slot time has elapsed

Jabber, long frame and range errors – Excessively or illegally long transmission

Short frame, collision fragment or runt – Illegally short transmission

FCS error – Corrupted transmission

Alignment error – Insufficient or excessive number of bits transmitted

Range error – Actual and reported number of octets in frame do not match

Ghost or jabber – Unusually long Preamble or Jam event

3.13 Ethernet auto-negotiation

As Ethernet grew from 10 to 100 and 1000 Mbps, one requirement was to make each technology interoperable, even to the point that 10, 100, and 1000 interfaces could be directly connected. A process called Auto-Negotiation of speeds at half or full duplex was developed. Specifically, at the time that Fast Ethernet was introduced, the standard included a method of automatically configuring a given interface to match the speed and capabilities of the link partner. This process defines how two link partners may automatically negotiate a configuration offering the best common performance level. It has the additional advantage of only involving the lowest part of the physical layer.

10BASE-T required each station to transmit a link pulse about every 16 milliseconds, whenever the station was not engaged in transmitting a message. Auto-Negotiation adopted this signal and renamed it a Normal Link Pulse (NLP). When a series of NLPs are sent in a group for the purpose of Auto-Negotiation, the group is called a Fast Link Pulse (FLP) burst. Each FLP burst is sent at the same timing interval as an NLP, and is intended to allow older 10BASE-T devices to operate normally in the event they should receive an FLP burst.

Auto-Negotiation is accomplished by transmitting a burst of 10BASE-T Link Pulses from each of the two link partners. The burst communicates the capabilities of the transmitting station to its link partner. After both stations have interpreted what the other partner is offering, both switch to the highest performance common configuration and establish a link at that speed. If anything interrupts communications and the link is lost, the two link partners first attempt to link again at the last negotiated speed. If that fails, or if it has been too long since the link was lost, the Auto-Negotiation process starts over. The link may be lost due to external influences, such as a cable fault, or due to one of the partners issuing a reset.

3.14 Link establishment & full and half duplex

Link partners are allowed to skip offering configurations of which they are capable. This allows the network administrator to force ports to a selected speed and duplex setting, without disabling Auto-Negotiation.

Auto-Negotiation is optional for most Ethernet implementations. Gigabit Ethernet requires its implementation, though the user may disable it. Auto-Negotiation was originally defined for UTP implementations of Ethernet and has been extended to work with other fiber optic implementations.When an Auto-Negotiating station first attempts to link it is supposed to enable 100BASE-TX to attempt to immediately establish a link. If 100BASE-TX signaling is present, and the station supports 100BASE-TX, it will attempt to establish a link without negotiating. If either signaling produces a link or FLP bursts are received, the station will proceed with that technology. If a link partner does not offer an FLP burst, but instead offers NLPs, then that device is automatically assumed to be a 10BASE-T station. During this initial interval of testing for other technologies, the transmit path is sending FLP bursts. The standard does not permit parallel detection of any other technologies.If a link is established through parallel detection, it is required to be half duplex. There are only two methods of achieving a full-duplex link. One method is through a completed cycle of Auto-Negotiation, and the other is to administratively force both link partners to full duplex. If one link partner is forced to full duplex, but the other partner attempts to Auto-Negotiate, then there is certain to be a duplex mismatch. This will result in collisions and errors on that link. Additionally if one end is forced to full duplex the other must also be forced. The exception to this is 10-Gigabit Ethernet, which does not support half duplex.

There are two duplex modes, half and full. For shared media, the half-duplex mode is mandatory.All coaxial implementations are half duplex in nature and cannot operate in full duplex. UTP and fiber implementations may be operated in half duplex. 10-Gbps implementations are specified for full duplex only.In half duplex only one station may transmit at a time. For the coaxial implementations a second station transmitting will cause the signals to overlap and become corrupted. Since UTP and fiber generally transmit on separate pairs the signals have no opportunity to overlap and become corrupted. Ethernet has established arbitration rules for resolving conflicts arising from instances when more than one station attempts to transmit at the same time. Both stations in a point-to-point full-duplex link are permitted to transmit at any time, regardless of whether the other station is transmitting.

3.15 10-Mbps Ethernet

10BASE5, 10BASE2, and 10BASE-T Ethernet are considered Legacy Ethernet.
The four common features of Legacy Ethernet are timing parameters, the frame format, transmission processes, and a basic design rule.10-Mbps Ethernet and slower versions are asynchronous. Each receiving station uses eight octets of timing information to synchronize its receive circuit to the incoming data. 10BASE5, 10BASE2, and 10BASE-T all share the same timing parameters.

10BASE5, 10BASE2, and 10BASE-T also have a common frame format.

The Legacy Ethernet transmission process is identical until the lower part of the OSI physical layer. As the frame passes from the MAC sublayer to the physical layer, other processes occur before the bits move from the physical layer onto the medium. One important process is the signal quality error (SQE) signal. The SQE is a transmission sent by a transceiver back to the controller to let the controller know whether the collision circuitry is functional. The SQE is also called a heartbeat. The SQE signal is designed to fix the problem in earlier versions of Ethernet where a host does not know if a transceiver is connected. SQE is always used in half-duplex. SQE can be used in full-duplex operation but is not required

Legacy Ethernet has common architectural features. Networks usually contain multiple types of media. The standard ensures that interoperability is maintained. The overall architectural design is most important in mixed-media networks. It becomes easier to violate maximum delay limits as the network grows. The timing limits are based on the following types of parameters:

  • Cable length and propagation delay
  • Delay of repeaters
  • Delay of transceivers
  • Interframe gap shrinkage
  • Delays within the station

10-Mbps Ethernet operates within the timing limits for a series of up to five segments separated by up to four repeaters. This is known as the 5-4-3 rule. No more than four repeaters can be used in series between any two stations. There can also be no more than three populated segments between any two stations.

10BASE5

10BASE5 transmitted 10 Mbps over a single thin coaxial cable bus.The primary benefit of 10BASE5 was length. 10BASE5 may be found in legacy installations. It is not recommended for new installations. 10BASE5 systems are inexpensive and require no configuration. Two disadvantages are that basic components like NICs are very difficult to find and it is sensitive to signal reflections on the cable. 10BASE5 systems also represent a single point of failure. 10BASE5 uses Manchester encoding.

10BASE2

Installation was easier because of its smaller size, lighter weight, and greater flexibility. 10BASE2 still exists in legacy networks. Like 10BASE5, it is no longer recommended for network installations. It has a low cost and does not require hubs.

10BASE2 also uses Manchester encoding. Only one station can transmit at a time or a collision will occur. 10BASE2 also uses half-duplex. The maximum transmission rate of 10BASE2 is 10 Mbps.There may be up to 30 stations on a 10BASE2 segment. Only three out of five consecutive segments between any two stations can be populated.

10BASE-T

10BASE-T used cheaper and easier to install Category 3 UTP copper cable instead of coax cable. The cable plugged into a central connection device that contained the shared bus. This device was a hub. It was at the center of a set of cables that radiated out to the PCs like the spokes on a wheel. This is referred to as a star topology. As additional stars were added and the cable distances grew, this formed an extended star topology. Originally 10BASE-T was a half-duplex protocol, but full-duplex features were added later..

10BASE-T also uses Manchester encoding. A 10BASE-T UTP cable has a solid conductor for each wire. The maximum cable length is 90 m (295 ft). UTP cable uses eight-pin RJ-45 connectors. Though Category 3 cable is adequate for 10BASE-T networks, new cable installations should be made with Category 5e or better. All four pairs of wires should be used either with the T568-A or T568-B cable pinout arrangement. This type of cable installation supports the use of multiple protocols without the need to rewire.

10BASE-T wiring and architecture

A 10BASE-T link generally connects a station to a hub or switch. Hubs are multi-port repeaters and count toward the limit on repeaters between distant stations. Hubs do not divide network segments into separate collision domains. Bridges and switches divide segments into separate collision domains. The maximum distance between bridges and switches is based on media limitations.

Although hubs may be linked, it is best to avoid this arrangement. A network with linked hubs may exceed the limit for maximum delay between stations. Multiple hubs should be arranged in hierarchical order like a tree structure. Performance is better if fewer repeaters are used between stations.
The distance from one end of the network to the other places the architecture at its limit. The most important aspect to consider is how to keep the delay between distant stations to a minimum, regardless of the architecture and media types involved. A shorter maximum delay will provide better overall performance.

10BASE-T links can have unrepeated distances of up to 100 m (328 ft). While this may seem like a long distance, it is typically maximized when wiring an actual building. Hubs can solve the distance issue but will allow collisions to propagate. The widespread introduction of switches has made the distance limitation less important. If workstations are located within 100 m (328 ft) of a switch, the 100-m distance starts over at the switch.

3.16 100-Mbps Ethernet

100-Mbps Ethernet, which is also known as Fast Ethernet. The two technologies that have become important are 100BASE-TX, which is a copper UTP medium and 100BASE-FX, which is a multimode optical fiber medium.

Three characteristics common to 100BASE-TX and 100BASE-FX are the timing parameters, the frame format, and parts of the transmission process. 100BASE-TX and 100BASE-FX both share timing parameters.

Note that one bit time at 100-Mbps = 10 ns =.01 microseconds = 1 100-millionth of a second.
The 100-Mbps frame format is the same as the 10-Mbps frame.
Fast Ethernet is ten times faster than 10BASE-T. The bits that are sent are shorter in duration and occur more frequently. These higher frequency signals are more susceptible to noise. In response to these issues, two separate encoding steps are used by 100-Mbps Ethernet. The first part of the encoding uses a technique called 4B/5B, the second part of the encoding is the actual line encoding specific to copper or fiber.

100BASE-TX

This page will describe 100BASE-TX.

In 1995, 100BASE-TX was the standard, using Category 5 UTP cable, which became commercially successful.

The original coaxial Ethernet used half-duplex transmission so only one device could transmit at a time. In 1997, Ethernet was expanded to include a full-duplex capability that allowed more than one PC on a network to transmit at the same time. Switches replaced hubs in many networks. These switches had full-duplex capabilities and could handle Ethernet frames quickly.

100BASE-TX uses 4B/5B encoding, which is then scrambled and converted to Multi-Level Transmit (MLT-3) encoding.

Notice that the two separate transmit-receive paths exist. This is identical to the 10BASE-T configuration.

100BASE-TX carries 100 Mbps of traffic in half-duplex mode. In full-duplex mode, 100BASE-TX can exchange 200 Mbps of traffic. The concept of full duplex will become more important as Ethernet speeds increase

100BASE-FX

When copper-based Fast Ethernet was introduced, a fiber version was also desired. A fiber version could be used for backbone applications, connections between floors, buildings where copper is less desirable, and also in high-noise environments. 100BASE-FX was introduced to satisfy this desire. However, 100BASE-FX was never adopted successfully. This was due to the introduction of Gigabit Ethernet copper and fiber standards. Gigabit Ethernet standards are now the dominant technology for backbone installations, high-speed cross-connects, and general infrastructure needs.

The timing, frame format, and transmission are the same in both copper and fiber versions of 100-Mbps Fast Ethernet. A fiber pair with either ST or SC connectors is most commonly used.

The separate Transmit (Tx) and Receive (Rx) paths in 100BASE-FX optical fiber allow for 200-Mbps transmission.

3.17 Fast Ethernet architecture

This page describes the architecture of Fast Ethernet.

Fast Ethernet links generally consist of a connection between a station and a hub or switch. Hubs are considered multi-port repeaters and switches are considered multi-port bridges.

A Class I repeater may introduce up to 140 bit-times latency. Any repeater that changes between one Ethernet implementation and another is a Class I repeater. A Class II repeater is restricted to smaller timing delays, 92 bit times, because it immediately repeats the incoming signal to all other ports without a translation process. To achieve a smaller timing delay, Class II repeaters can only connect to segment types that use the same signaling technique.

3.18 1000-Mbps Ethernet Or Gigabit Ethernet Standards

These standards specify both fiber and copper media for data transmissions. The 1000BASE-T standard, IEEE 802.3ab, uses Category 5, or higher, balanced copper cabling. The 1000BASE-X standard, IEEE 802.3z, specifies 1 Gbps full duplex over optical fiber.

They use a 1 ns, 0.000000001 of a second, or 1 billionth of a second bit .The differences between standard Ethernet, Fast Ethernet and Gigabit Ethernet occur at the physical layer. Due to the increased speeds of these newer standards, the shorter duration bit times require special considerations. Since the bits are introduced on the medium for a shorter duration and more often, timing is critical. This high-speed transmission requires higher frequencies. This causes the bits to be more susceptible to noise on copper media.

These issues require Gigabit Ethernet to use two separate encoding steps. Data transmission is more efficient when codes are used to represent the binary bit stream. The encoded data provides synchronization, efficient usage of bandwidth, and improved signal-to-noise ratio characteristics.

At the physical layer, the bit patterns from the MAC layer are converted into symbols. The symbols may also be control information such as start frame, end frame, and idle conditions on a link. The frame is coded into control symbols and data symbols to increase in network throughput.

Fiber-based Gigabit Ethernet, or 1000BASE-X, uses 8B/10B encoding, which is similar to the 4B/5B concept. This is followed by the simple nonreturn to zero (NRZ) line encoding of light on optical fiber. This encoding process is possible because the fiber medium can carry higher bandwidth signals.

1000BASE-T

As Fast Ethernet was installed to increase bandwidth to workstations, this began to create bottlenecks upstream in the network. The 1000BASE-T standard, which is IEEE 802.3ab, was developed to provide additional bandwidth to help alleviate these bottlenecks. It provided more throughput for devices such as intra-building backbones, inter-switch links, server farms, and other wiring closet applications as well as connections for high-end workstations. Fast Ethernet was designed to function over Category 5 copper cable that passes the Category 5e test. Most installed Category 5 cable can pass the Category 5e certification if properly terminated. It is important for the 1000BASE-T standard to be interoperable with 10BASE-T and 100BASE-TX.

Since Category 5e cable can reliably carry up to 125 Mbps of traffic, 1000 Mbps or 1 Gigabit of bandwidth was a design challenge. The first step to accomplish 1000BASE-T is to use all four pairs of wires instead of the traditional two pairs of wires used by 10BASE-T and 100BASE-TX. This requires complex circuitry that allows full-duplex transmissions on the same wire pair. This provides 250 Mbps per pair. With all four-wire pairs, this provides the desired 1000 Mbps. Since the information travels simultaneously across the four paths, the circuitry has to divide frames at the transmitter and reassemble them at the receiver.

The 1000BASE-T encoding with 4D-PAM5 line encoding is used on Category 5e, or better, UTP

1000BASE-SX and LX

This page will discuss single-mode and multimode optical fiber.

The IEEE 802.3 standard recommends that Gigabit Ethernet over fiber be the preferred backbone technology.

The timing, frame format, and transmission are common to all versions of 1000 Mbps. Two signal-encoding schemes are defined at the physical layer.
The 8B/10B scheme is used for optical fiber and shielded copper media, and the pulse amplitude modulation 5 (PAM5) is used for UTP.

1000BASE-X uses 8B/10B encoding converted to non-return to zero (NRZ) line encodingThe short-wavelength uses an 850 nm laser or LED source in multimode optical fiber (1000BASE-SX). It is the lower-cost of the options but has shorter distances. The long-wavelength 1310 nm laser source uses either single-mode or multimode optical fiber (1000BASE-LX). Laser sources used with single-mode fiber can achieve distances of up to 5000 meters. Because of the length of time to completely turn the LED or laser on and off each time, the light is pulsed using low and high power. A logic zero is represented by low power, and a logic one by high power.

The Media Access Control method treats the link as point-to-point. Since separate fibers are used for transmitting (Tx) and receiving (Rx) the connection is inherently full duplex. Gigabit Ethernet permits only a single repeater between two stations

3.19 Gigabit Ethernet architecture

The distance limitations of full-duplex links are only limited by the medium, and not the round-trip delay.Daisy-chaining, star, and extended star topologies are all allowed. The issue then becomes one of logical topology and data flow, not timing or distance limitations.

A 1000BASE-T UTP cable is the same as 10BASE-T and 100BASE-TX cable, except that link performance must meet the higher quality Category 5e or ISO Class D (2000) requirements.

Modification of the architecture rules is strongly discouraged for 1000BASE-T. At 100 meters, 1000BASE-T is operating close to the edge of the ability of the hardware to recover the transmitted signal. Any cabling problems or environmental noise could render an otherwise compliant cable inoperable even at distances that are within the specification.

It is recommended that all links between a station and a hub or switch be configured for Auto-Negotiation to permit the highest common performance. This will avoid accidental misconfiguration of the other required parameters for proper Gigabit Ethernet operation.

10-Gigabit Ethernet

IEEE 802.3ae was adapted to include 10 Gbps full-duplex transmission over fiber optic cable. The basic similarities between 802.3ae and 802.3, the original Ethernet are remarkable. This 10-Gigabit Ethernet (10GbE) is evolving for not only LANs, but also MANs, and WANs.

With the frame format and other Ethernet Layer 2 specifications compatible with previous standards, 10GbE can provide increased bandwidth needs that are interoperable with existing network infrastructure.

A major conceptual change for Ethernet is emerging with 10GbE. Ethernet is traditionally thought of as a LAN technology, but 10GbE physical layer standards allow both an extension in distance to 40 km over single-mode fiber and compatibility with synchronous optical network (SONET) and synchronous digital hierarchy (SDH) networks. Operation at 40 km distance makes 10GbE a viable MAN technology. Compatibility with SONET/SDH networks operating up to OC-192 speeds (9.584640 Gbps) make 10GbE a viable WAN technology. 10GbE may also compete with ATM for certain applications.

  • Frame format is the same, allowing interoperability between all varieties of legacy, fast, gigabit, and 10 gigabit, with no reframing or protocol conversions.
  • Bit time is now 0.1 nanoseconds. All other time variables scale accordingly.
  • Since only full-duplex fiber connections are used, CSMA/CD is not necessary.
  • The IEEE 802.3 sublayers within OSI Layers 1 and 2 are mostly preserved, with a few additions to accommodate 40 km fiber links and interoperability with SONET/SDH technologies.
  • Flexible, efficient, reliable, relatively low cost end-to-end Ethernet networks become possible.
  • TCP/IP can run over LANs, MANs, and WANs with one Layer 2 transport method.

The basic standard governing CSMA/CD is IEEE 802.3. An IEEE 802.3 supplement, entitled 802.3ae, governs the 10GbE family. As is typical for new technologies, a variety of implementations are being considered, including:

  • 10GBASE-SR – Intended for short distances over already-installed multimode fiber, supports a range between 26 m to 82 m
  • 10GBASE-LX4 – Uses wavelength division multiplexing (WDM), supports 240 m to 300 m over already-installed multimode fiber and 10 km over single-mode fiber
  • 10GBASE-LR and 10GBASE-ER – Support 10 km and 40 km over single-mode fiber
  • 10GBASE-SW, 10GBASE-LW, and 10GBASE-EW – Known collectively as 10GBASE-W, intended to work with OC-192 synchronous transport module SONET/SDH WAN equipment

The IEEE 802.3ae Task force and the 10-Gigabit Ethernet Alliance (10 GEA) are working to standardize these emerging technologies.

10-Gbps Ethernet (IEEE 802.3ae) was standardized in June 2002. It is a full-duplex protocol that uses only optic fiber as a transmission medium. The maximum transmission distances depend on the type of fiber being used. When using single-mode fiber as the transmission medium, the maximum transmission distance is 40 kilometers (25 miles). Some discussions between IEEE members have begun that suggest the possibility of standards for 40, 80, and even 100-Gbps Ethernet.

3.20 Shared media environments

Here are some examples of shared media and directly connected networks:

  • Shared media environment – This occurs when multiple hosts have access to the same medium. For example, if several PCs are attached to the same physical wire or optical fiber, they all share the same media environment.
  • Extended shared media environment – This is a special type of shared media environment in which networking devices can extend the environment so that it can accommodate multiple access or longer cable distances.
  • Point-to-point network environment – This is widely used in dialup network connections and is most common for home users. It is a shared network environment in which one device is connected to only one other device. An example is a PC that is connected to an Internet service provider through a modem and a phone line.

3.21 5-4-3-2-1 Rule

The 5-4-3-2-1 rule requires that the following guidelines should not be exceeded:

  • Five segments of network media
  • Four repeaters or hubs
  • Three host segments of the network
  • Two link sections with no hosts
  • One large collision domain

The 5-4-3-2-1 rule also provides guidelines to keep round-trip delay time within acceptable limits.

3.22 Segmentation

One important skill for a networking professional is the ability to recognize collision domains.
A collision domain is created when several computers are connected to a single shared-access medium that is not attached to other network devices. This situation limits the number of computers that can use the segment. Layer 1 devices extend but do not control collision domains. Layer 2 devices segment or divide collision domains.
They use the MAC address assigned to every Ethernet device to control frame propagation. Layer 2 devices are bridges and switches. They keep track of the MAC addresses and their segments. This allows these devices to control the flow of traffic at the Layer 2 level. This function makes networks more efficient. It allows data to be transmitted on different segments of the LAN at the same time without collisions. Bridges and switches divide collision domains into smaller parts. Each part becomes its own collision domain.

These smaller collision domains will have fewer hosts and less traffic than the original domain.
The fewer hosts that exist in a collision domain, the more likely the media will be available. If the traffic between bridged segments is not too heavy a bridged network works well. Otherwise, the Layer 2 device can slow down communication and become a bottleneck.

Layer 2 and 3 devices do not forward collisions. Layer 3 devices divide collision domains into smaller domains.

Layer 3 devices also perform other functions. These functions will be covered in the section on broadcast domains.

Layer 2 broadcasts

To communicate with all collision domains, protocols use broadcast and multicast frames at Layer 2 of the OSI model.
When a node needs to communicate with all hosts on the network, it sends a broadcast frame with a destination MAC address 0xFFFFFFFFFFFF. This is an address to which the NIC of every host must respond.

Layer 2 devices must flood all broadcast and multicast traffic. The accumulation of broadcast and multicast traffic from each device in the network is referred to as broadcast radiation. In some cases, the circulation of broadcast radiation can saturate the network so that there is no bandwidth left for application data. In this case, new network connections cannot be made and established connections may be dropped. This situation is called a broadcast storm. The probability of broadcast storms increases as the switched network grows.

A NIC must rely on the CPU to process each broadcast or multicast group it belongs to. Therefore, broadcast radiation affects the performance of hosts in the network.A host does not usually benefit if it processes a broadcast when it is not the intended destination. The host is not interested in the service that is advertised. High levels of broadcast radiation can noticeably degrade host performance. The three sources of broadcasts and multicasts in IP networks are workstations, routers, and multicast applications.

Workstations broadcast an Address Resolution Protocol (ARP) request every time they need to locate a MAC address that is not in the ARP table.
Although the numbers in the figure might appear low, they represent an average, well-designed IP network. When broadcast and multicast traffic peak due to storm behavior, peak CPU loss can be much higher than average. Broadcast storms can be caused by a device that requests information from a network that has grown too large. So many responses are sent to the original request that the device cannot process them, or the first request triggers similar requests from other devices that effectively block normal traffic flow on the network.The routing protocols that are configured on a network can increase broadcast traffic significantly. IP multicast applications can adversely affect the performance of large, scaled, switched networks. Multicasting is an efficient way to send a stream of multimedia data to many users on a shared-media hub. However, it affects every user on a flat switched network. A packet video application could generate a 7-MB stream of multicast data that would be sent to every segment. This would result in severe congestion.

3.23 Broadcast domains

A broadcast domain is a group of collision domains that are connected by Layer 2 devices.
When a LAN is broken up into multiple collision domains, each host in the network has more opportunities to gain access to the media. This reduces the chance of collisions and increases available bandwidth for every host. Broadcasts are forwarded by Layer 2 devices. Excessive broadcasts can reduce the efficiency of the entire LAN. Broadcasts have to be controlled at Layer 3 since Layers 1 and 2 devices cannot control them. A broadcast domain includes all of the collision domains that process the same broadcast frame. This includes all the nodes that are part of the network segment bounded by a Layer 3 device. Broadcast domains are controlled at Layer 3 because routers do not forward broadcasts. Routers actually work at Layers 1, 2, and 3. Like all Layer 1 devices, routers have a physical connection and transmit data onto the media. Routers also have a Layer 2 encapsulation on all interfaces and perform the same functions as other Layer 2 devices. Layer 3 allows routers to segment broadcast domains.

In order for a packet to be forwarded through a router it must have already been processed by a Layer 2 device and the frame information stripped off. Layer 3 forwarding is based on the destination IP address and not the MAC address. For a packet to be forwarded it must contain an IP address that is outside of the range of addresses assigned to the LAN and the router must have a destination to send the specific packet to in its routing table

3.24 Introduction to data flow

Data flow in the context of collision and broadcast domains focuses on how data frames propagate through a network .A good rule to follow is that a Layer 1 device always forwards the frame, while a Layer 2 device wants to forward the frame. In other words, a Layer 2 device will forward the frame unless something prevents it from doing so. A Layer 3 device will not forward the frame unless it has to. Using this rule will help identify how data flows through a network.

Layer 1 devices do no filtering, so everything that is received is passed on to the next segment. The frame is simply regenerated and retimed and thus returned to its original transmission quality. Any segments connected by Layer 1 devices are part of the same domain, both collision and broadcast.

Layer 2 devices filter data frames based on the destination MAC address. A frame is forwarded if it is going to an unknown destination outside the collision domain. The frame will also be forwarded if it is a broadcast, multicast, or a unicast going outside of the local collision domain. The only time that a frame is not forwarded is when the Layer 2 device finds that the sending host and the receiving host are in the same collision domain. A Layer 2 device, such as a bridge, creates multiple collision domains but maintains only one broadcast domain.

Layer 3 devices filter data packets based on IP destination address. The only way that a packet will be forwarded is if its destination IP address is outside of the broadcast domain and the router has an identified location to send the packet. A Layer 3 device creates multiple collision and broadcast domains.

Data flow through a routed IP based network, involves data moving across traffic management devices at Layers 1, 2, and 3 of the OSI model. Layer 1 is used for transmission across the physical media, Layer 2 for collision domain management, and Layer 3 for broadcast domain management.

3.25 What is a network segment?

In the context of data communication, network segment is defined as the following:

  • Section of a network that is bounded by bridges, routers, or switches.
  • In a LAN using a bus topology, a segment is a continuous electrical circuit that is often connected to other such segments with repeaters.
  • Term used in the TCP specification to describe a single transport layer unit of information. The terms datagram, frame, message, and packet are also used to describe logical information groupings at various layers of the OSI reference model and in various technology circles.