Diving deep in the OSI model is not the goal of this chapter, but you do need to focus on Layer 2, the data link layer, to put Ethernet technologies into perspective. The data link layer has two sublayers, as illustrated in Figure 1-1:

Figure 1-1. The OSI Reference Model

The focus of the subsequent sections surrounds the MAC layer. This layer is unique to 802.3 networks and as such provides a reference point as you progress through the chapters on the wireless MAC.

Figure 1-2 depicts an Ethernet frame.

Figure 1-2. The Ethernet Frame

As Figure 1-2 illustrates, the Ethernet frame consists of the following fields:

Ethernet addresses are 48-bit values that uniquely identify Ethernet stations on a LAN. Ethernet addresses are in part issued by a global authority, the IEEE, and in part by device vendors. The IEEE assigns unique 24-bit organizational unique identifiers (OUIs) to vendors. The OUI is the first 24 bits of the Ethernet address. The vendors themselves assign the remaining 24 bits. This process ensures that every Ethernet address is unique, and any station can connect to any network in world and be uniquely identified. Because this addressing describes a physical interface, it is also referred to as MAC addressing. For the most part, MAC addresses are expressed in hexadecimal form, with each byte separated by a dash or colon, or with every 2 bytes delimited with a period. For example, the following is an Ethernet address from a Cisco router:

You can also represent this value as

The IEEE has assigned the first 24 bits, 00-03-6b, to Cisco. The remaining 24 bits, 48-e9-20, have been assigned by Cisco to the device. The OUI of 00-03-6b allows the vendor to assign a range of addresses starting from 00-03-6b-00-00-00 to 00-03-6b-ff-ff-ff. This provides the vendor a total of 2²⁴ or 16,777,216 possible addresses.

The Ethernet networking standard is based on the CSMA/CD architecture. CSMA/CD is a half-duplex architecture, meaning only one station can transmit at a time. You can compare the CSMA/CD architecture to people communicating in a conference-call meeting:

Ethernet functions in the same way as the conference call. The carrier-sense portion of CSMA/CD refers to the capability of stations to determine whether the Ethernet medium is currently in use. There is no actual carrier signal, so the stations are actually sensing a lack of signal, indicating the medium is not is use. The multiple-access portion of CSMA/CD refers to the capability of the medium to support many users at the same time. Like the conference-call participants, all stations have equal access to the medium, but they must wait until the medium is available for transmitting. As the number of stations on the Ethernet medium increases, so does the possibility of frame collision. A collision occurs when two stations transmit at the same time on the medium. Neither station's transmitted data is usable, so the stations must retransmit. Finally, collision detection refers to the capability of the stations to detect that a collision has occurred. The Ethernet specification provides a fair mechanism for the stations whose frames have collided to retransmit.

The network diameter consists of the distance between Ethernet stations at the extreme ends of a broadcast domain. You can interconnect the devices with hubs, repeaters, switches, or bridges. The rules for 802.3 Ethernet networks state that a collision needs to be detectable within the time it takes to transmit the smallest legal Ethernet frame. The smallest legal frame is 64 bytes or 512 bits. Given the speed of electricity across the wire and the data rate of the medium (10 Mbps), the maximum wire length for Ethernet networks is 2800 meters (m). The time it takes for an Ethernet frame to traverse the network diameter is known as the Ethernet slot time.

Consider Figure 1-4 where two stations are at extreme ends of the broadcast domain:

Figure 1-4. Collision Within a Broadcast Domain

This scenario also holds true if the media length extends beyond the 2800 m limit.

A station can address its frames for transmission using one of three methods:

Figure 1-5 depicts these addressing types. Ethernet networks use all three methods. No one method is a panacea. Each method has pros and cons for its use.

Figure 1-5. Addressing Types

An Ethernet broadcast address has a special 48-bit destination address. It is called the “all 1s” address because every bit is a 1 (or every byte is the ff value in hex). A broadcast address can look like ff-ff-ff-ff-ff-ff or ffff.ffff.ffff. A station wanting to transmit a frame to all stations on the medium sends the frame with a destination address of the broadcast address.

Broadcast frames are received and processed by every station on the medium. Every station runs through the logic in Figure 1-6 to determine whether the frame contains data that is destined for it. You don't want the station to process a large number of frames that are not destined for it. A station receiving the unwanted broadcast frames uses its CPU to process the frames that could be and should be used by other station resources. This process might seem trivial, but broadcast storm have been known to cripple networks and the stations that the networks interconnect.

Figure 1-6. Station Determining Whether to Process a Frame

Multicast frames are similar to broadcast frames in that they allow the sender to address a group of receivers as opposed to a single receiver. This process reduces overall network utilization in some cases by eliminating the need for a station to retransmit the same frame several times to reach all the intended receivers. Multicast frames must be “subscribed to,” meaning that the receiver must desire to receive them. If the receiver does not subscribe to receive multicasts from a particular group address, it discards the frames.

As an example, take streaming video to a station. Video generally has a high packet rate, and if the source broadcasts the video stream to all the stations in the broadcast domain, a station that is not actively using the video stream expends a large number of CPU cycles to process and discard the frame contents. A common mechanism for streaming video content is IP multicast. IP multicast frames are sent to a special destination IP address and with a special destination MAC OUI of 01-00-5E. For example, Enhanced Interior Gateway Routing Protocol (EIGRP), an IP routing protocol, sends routing updates to the IP multicast group of 224.0.0.10. This group corresponds to an Ethernet address of 01-00-5E-00-00-0A. All devices that care to receive EIGRP routing updates accept frames destined to that address. Devices that do not subscribe to EIGRP routing updates discard the frame.

In theory, multicast and broadcast frames can reduce network utilization by allowing a station to send a single frame to many destinations simultaneously. But if the sending station targets a small number of destination stations, or even a single destination station, broadcast and multicast traffic can create additional processing for unintended stations.

Unicast addressing is the simplest and most straightforward manner of sending data to a destination station. The transmitting station sends the frame with the specific Ethernet address of the receiving station as the destination address. Only the receiving station accepts and processes the frame and its contents.

Ethernet provides these three modes of addressing so applications can use the most appropriate mode that has the least impact to the network.

Ethernet comes in a number of forms, including 10BASE2, 10BASE5 10BASE-T, and 10BASE-FL. Each of the Ethernet variants has advantages and drawbacks over the other types. In addition, similar media types are not mentioned because of a lack of installed base and customer acceptance.

10BASE-T is the most common twisted-pair Ethernet media. It allows for network connectivity over voice grade Category 3 unshielded twisted-pair (UTP) cabling using only two pairs of wire. Although 10BASE-T requires only Category 3 cabling, a large number of deployments are on Category 5 cabling for upgradeability to enhanced topologies such as 100BASE-TX or 1000BASE-T. Also, Category 5 cabling provides a higher grade of cable that allows for enhanced signal quality. The term 10BASE-T refers to the capability of the medium to operate at 10 Mbps using a baseband signal over twisted-pair cabling. 10BASE-T allows for cable runs of roughly 100 m, although Ethernet itself supports distances up to 2800 m. This difference is because of signal degradation across the UTP cabling.

10BASE-T stations are physically connected to an aggregation device of some kind (a repeater, hub, or switch) to form a physical star topology. Although the network is a physical star, it operates as a logical bus architecture, as shown in Figure 1-7. The benefit of the physical-star topology is that a break in any one station's cable does not impact the network connectivity of any other station.

Figure 1-7. 10BASE-T Topology

Before 10BASE-T was popular, 10BASE2 was the topology that ruled the smaller networks of the Ethernet world. The naming of 10BASE2 refers to the 10 Mbps baseband signaling that can run roughly 200 m over RG-58 coaxial cable (see Figure 1-9 in the next section). Although the “2” in 10BASE2 refers to 200 m, 10BASE2 networks can only span 185 m. Evidently, the IEEE likes to be optimistic and round up. 10BASE2 was popular because cabling was relatively inexpensive and networks could be rapidly deployed. 10BASE2 runs over RG-59 or RG-59 coaxial cabling, and the entire network is physically connected to a contiguous length of wire. Stations are connected directly to the media using T connectors. A break anywhere in the cabling brings the entire network down.

Figure 1-9. Gigabit Ethernet Carrier Extensions

Another common media type is 10BASE5, which runs over a much thicker coaxial cable (about the girth of a garden hose). The cable is far more expensive and unwieldy to manage. Adding stations to 10BASE5 requires costly transceivers as well. Each station is connected to a transceiver, which in turn taps into the media. As with 10BASE2, a break in the media causes all stations to lose network connectivity.

10BASE-FL is the most common implementation of Ethernet over multimode fiber. 10BASE-FL supports distances of up to 2 kilometers (km), and it would not be uncommon to see 10BASE-FL links connect distant Ethernet networks together. 10BASE-FL requires two strands of multimode fiber, one strand for transmit and the other for receive.

CSMA/CD is the methodology that half-duplex Ethernet and Fast Ethernet is based on. As described earlier, CSMA/CD is like a telephone conference call. Each participant must wait until the medium is available before he can speak. In 1995, the IEEE ratified 802.3x, which specifies a new methodology for transmission in Ethernet networks known as full-duplex operation. Full-duplex operation allows a station to send and receive frames simultaneously, allowing greater use of the medium and higher overall throughput (see Figure 1-8). Full-duplex operation significantly changes the requirements placed on end stations, however.

Figure 1-8. Full-Duplex Operation

Full-duplex operation works only in a point-to-point environment. There can be only one other device in the collision domain. Stations connected to hubs, repeaters, and the like are unable to operate in full-duplex mode. Stations connected back-to-back or connected to Layer 2 switches (that support full-duplex mode) are able to use full-duplex mode.

The capability to transmit and receive at the same rate allows stations to better utilize the network medium. The bandwidth available to the station is theoretically doubled because the station has full access to the medium in the send direction and the receive direction. In the case of 100BASE-X, this access gives each station up to 200 Mbps of maximum bandwidth. For end stations, such as PCs, the truth is that few stations transmit and receive at the same time. Stations such as servers and networking infrastructure such as routers and switches can take advantage of full-duplex mode in a manner that end stations cannot. The devices aggregate sessions and connections from the edge of the network to the core and back. They send and receive traffic distributed in both the send and receive directions, so these links are able to really take advantage of the extra bandwidth that full-duplex operation provides.

Full-duplex operation allows Ethernet topologies to break free from the distance limitations that half-duplex operations impose on them. Ironically, only fiber-based interfaces can take advantage of additional distances (as 100BASE-FX does) because twisted-pair deployments are distance-limited by the physical medium itself and not the network diameter imposed by Ethernet or Fast Ethernet time slots.

The development of the 1000BASE-T standard stemmed from the efforts of Fast Ethernet development. The search for the ideal Fast Ethernet copper solution drove the adoption of 100BASE-TX. Although not well known, there were two other standards: 100BASE-T4 and 100BASE-T2. 100BASE-T4 was not a popular solution because it required the use of all four pairs of Category 3 or 5 cabling. Some installations wired only two-pair Category 3 or 5 cabling in accordance with the requirements of 10BASE-T. 100BASE-T4 also missed the mark by not supporting full-duplex operation.

100BASE-T2 was a more far-reaching specification, enabling 100 Mbps operation over Category 3 cabling using only two pairs. The problem is that no vendor ever implemented the standard. When the time came to develop the gigabit solution for the Ethernet standard, developers took the best of all the 100 Mbps standards and incorporated them into the 1000BASE-T specification.

802.3z was ratified in 1999 and included in the 802.3 standard. 1000BASE-X is the specification for Gigabit Ethernet over a fiber-optic medium. The underlying technology itself is not new because it is based on the ANSI Fibre Channel standard (ANSI X3T11). 1000BASE-X comes in three media types: 1000BASE-SX, 1000BASE-LX, and 1000BASE-CX. 1000BASE-SX is the most common and least expensive media, using standard multimode fiber. The low cost is not without shortcomings; 1000BASE-SX has a maximum distance of 220 m (compared with full-duplex 100BASE-FX at 2 km). 1000BASE-LX generally utilizes single-mode fiber and can span distances up to 5 km.

1000BASE-CX is the oddball of the three media types. It is a copper-based solution that requires precrimped shielded twisted-pair cabling. The connector is not the familiar RJ-45 of 10/100/1000BASE-T. Instead, you use either a DB-9 or HSSDC connector to terminate the two pairs of wire. 1000BASE-CX can span lengths of up to 25 m, relegating it to wiring closet patches. 1000BASE-CX is not all that common because 1000BASE-T provides the same function for a fraction of the price, and four times the cable length, using standard four-pair, Category 5 cabling.

The network diameter for Gigabit Ethernet presents a challenge. In half-duplex mode, the rules of Ethernet state that a 512-bit frame is the minimum frame size required for all stations to “hear” the frame and propagate a collision-detect message to all stations before the sending station discards the frame. Using the methodologies from previous sections, a 1000BASE-T or 1000BASE-X link would be limited to 20 m because the medium is able to transmit frames 10 times faster than its predecessor (roughly 200 m for 100BASE-TX divided by 10 equals 20 m).

The 20 m doesn't scale all that well in most situations, so to overcome this limitation, the IEEE required that the minimum frame size be increased 8-fold to 4096 bits (512 bytes) for Gigabit Ethernet. Instead of padding the payload portion of the frame, the standard instead opted to employ the use of a new feature known as carrier extensions.

For example, suppose a Gigabit Ethernet station detects a clear medium and wants to transmit a 512-bit frame. The NIC adds to the end of the frame 3,584 carrier-extension bits. These bits are known to other Gigabit Ethernet stations not to be data yet are considered part of the frame itself (see Figure 1-9). When the receiving station receives the frame, it discards the carrier extension. This process allows a small frame to be transmitted without concern for late collisions.

Although the use of carrier extensions solves the network-diameter problem, it creates a new one in its wake. For every small 512-bit frame transmitted, seven times that amount of carrier extension is also transmitted. It is a waste of bandwidth. To alleviate this overhead, the standard specifies a burst mode as an optional method to solve the slot-time issue and the carrier-extension overhead issue.

Burst mode allows small frames to chain together by sending carrier extensions in the interframe gap. Other stations wanting to transmit see the interframe gap but still detect carrier and avoid transmission. The standard allows for up to 64 kilobits (Kb) of burst-mode traffic to pass before sending a standard interframe gap.

The mechanism first sends a small frame with the full 4096-bit frame size (including carrier-extension bits). It does so to weed out any possible collisions with other stations. After the first frame is sent successfully, the subsequent interframe gap contains the extension bits to prevent other stations from accessing the medium (see Figure 1-10). Subsequent frames are transmitted without any carrier-extension padding. The station can burst up to 64 Kb of additional frames before relinquishing control of the medium. This mechanism, although not perfect, allows better utilization of the medium than carrier extensions alone.

Figure 1-10. Gigabit Burst Mode

Given the numerous possible combinations of Ethernet data rates and duplex modes, auto negotiation takes the guesswork out of determining device compatibility. In general, auto negotiation of speed and duplex is designed for twisted-pair media because fiber-optic devices do not support auto negotiation, nor is it practical for fiber-optic media types.

The auto-negotiation process begins when the device detects link activity on its interface:

If one station supports auto negotiation and the other does not, the auto negotiation uses medium auto sense. For example, an older 10BASE-T station can connect to a switch that supports auto negotiation. The switch sends a FLP to the 10BASE-T station requesting 100 Mbps full-duplex operation. The 10BASE-T station does not understand the FLP and ignores the auto-negotiation signaling. By the same token, the 10BASE-T station cannot send a FLP as it does not support them. The switch port senses the lack of FLP support and assumes the station is a 10BASE-T station. In this case, because the 10BASE-T station does not support auto negotiation, the switch reverts to the lowest common denominator, which is 10BASE-T.

Yet, what if the station is a 100BASE-TX station running in half-duplex mode and does not support auto negotiation either? Will these stations be doomed to run in 10BASE-T mode? The answer is no. FLPs are based on the network link pulse (NLP) specified in the Ethernet standard. NLPs are periodic pulses that are essentially the network heartbeat. FLPs provide a similar function for 100BASE-X networks, just 10 times as often. So although the 100BASE-TX station does not engage in auto negotiation, it does send FLPs, which indicate to the switch that the station does support 100 Mbps operation. This indication is what allows an auto-sense device to determine whether a station is 100BASE-TX or 10BASE-T.

Auto negotiation is somewhat different in Gigabit Ethernet networks than in Fast Ethernet and Ethernet networks. Copper-based 1000BASE-T conforms to the same FLP mechanism that the other topologies use, as would be expected. But 1000BASE-X uses a different mechanism. Auto negotiation is medium dependant, and as a result, only like 1000BASE-X devices can auto negotiate with each other. Because access rate is predetermined (that is, speed negotiation is not supported), the only option is duplex mode. Unlike Ethernet and Fast Ethernet, FLPs are not used for negotiation and are instead abandoned in favor of signaling that is specific to each of the 1000BASE-X media types.