CCC NET 125 Chapter 5

Organizationally Unique Identifier - OUI

The first half of a MAC address. Manufacturers must ensure that the value of this has been registered with the IEEE. This value identifies the manufacturer of any Ethernet NIC or interface.

Source Address

The frame's originating NIC or interface MAC address

switch fabric

The integrated circuits and the accompanying machine programming in a switch that allow the data paths through the switch to be controlled.

next hop

The next gateway to which a Layer 3 packet is delivered, used to reach its destination.

power over Ethernet - PoE

The powering of network devices over Ethernet cable. This is defined by two different standards: IEEE 802.3af and Cisco.

Data encapsulation Media access control

The two primary functions of Media Access Control are:

Cisco Express Forwarding - CEF

A Layer 3 switching method. This technique speeds up packet forwarding by decoupling the usual strict interdependence between Layer 2 and Layer 3 decision making. The forwarding decision information is stored in several data structures for CEF switching. This forwarding information can be rapidly referenced to expedite packet forwarding decisions.

Forwarding Information Base - FIB

A data structure that contains all routes known. Conceptually the FIB is similar to a routing table. A networking device uses the FIB lookup table to make destination-based switching decisions.

automatic medium-dependent interface crossover - auto-MDIX

A detection on a switch port or hub port to detect the type of cable used between switches or hubs. Once the cable type is detected, the port is connected and configured accordingly. With auto-MDIX, a crossover or a straight-through cable can be used for connections to a copper 10/100/1000 port on the switch, regardless of the type of device on the other end of the connection.

protocol data unit - PDU

A generic term from OSI that refers to the data, headers, and trailers about which a particular networking layer is concerned.

CSMA/Collision Avoidance (CSMA/CA)

A mechanism that regulates the transmission of data onto a network medium. It is similar to CSMA/CD except the devices first request the right to send, which hopefully avoids collisions. Used in 802.11 LANs.

contention-based

A method of networking that is a non-deterministic method. That is, any device can try to transmit data across the shared medium whenever it has data to send.

Virtual Local Area Network - VLAN

A network of end devices that behave as if they are connected to the same network segment, even though they might be physically located on different segments of a LAN. These are configured through software on the switch and router - IOS on Cisco routers and switches.

hexadecimal - Base 16

A number system using the digits 0 through 9, with their usual meaning, plus the letters A through F to represent hexadecimal digits with values of 10 to 15. The right-most digit counts ones, the next counts multiples of 16...

spoofing

A person or program masquerades as another to gain access to data and the network.

traffic prioritization

A process in Quality of Service (QoS) where frames are forwarded in priority order based on their marking.

asymmetric switching

A switching technique used to allow for different data rates on different ports.

adjacency table

A table in a router that contains a list of the relationship formed between selected neighboring routers and end nodes for the purpose of exchanging routing information. This is based upon the use of a common media segment.

cyclic redundancy check - CRC

A type of hash function (one-way encryption) that is used to produce a small, fixed-size checksum of a block of data, such as a packet or a computer file. This is computed and appended before transmission or storage, and verified afterward by the recipient to confirm that no changes have happened in transit. Error-checking technique in which the frame recipient calculates a remainder by dividing frame contents by a prime binary divisor and compares the calculated remainder to a value stored in the frame by the sending node.

requests, unicast

ARP _____ are sent to a broadcast MAC address, and ARP replies are sent to a _____ MAC address.

collision fragment

Any frame less than 64 bytes in length. These frames are automatically discarded by receiving stations. Also called runt frames.

Destination Address

Assists a host in determining if the frame received is addressed to it

The Data Link and Physical layers. Ethernet standards define both the data link layer protocols and the physical layer technologies.

At which layers of the OSI model does Ethernet function?

store-and-forward

Buffers frames until the full frame has been received by the switch.

Frame check sequence

Detects errors in an Ethernet frame

store-and-forward

Checks the frame for errors before releasing it out of its switch ports - if the full frame was not received, the switch discards it.

MAC

Controls access to the media through signaling and physical media standards requirements.

LLC

Controls the network interface card through software drivers.

0F, 0x0F

Convert the decimal number 15 to hexadecimal and show the two different ways it can be correctly represented in text.

Frame delimiting - The framing process provides important delimiters that are used to identify a group of bits that make up a frame. These delimiting bits provide synchronization between the transmitting and receiving nodes. Addressing - The encapsulation process contains the Layer 3 PDU and also provides for data link layer addressing. Error detection - Each frame contains a trailer used to detect any errors in transmissions.

Data encapsulation provides three primary functions. These are:

Type

Describes which higher-layer protocol has been used

If a device does not receive a frame from a particular device by the time the time stamp expires, the entry for this device is removed from the ARP table.

Entries in the ARP table are time stamped. What does this mean?

Ethernet is defined by the IEEE 802.2 and 802.3 standards.

Ethernet is defined by which IEEE standards

Ethernet operates in the data link layer and the physical layer.

Ethernet operates at what OSI layers?

The switch acts upon the data as soon as it is received, even if the transmission is not complete. It only buffers enough of the frame to read the destination MAC address, then sends it on its way. Does not do any error checking, the destination device does that. This is faster than store-and-forward, but may consume unnecessary bandwidth if frames are corrupted.

Explain cut-through switching

Fast-forward switching offers the lowest level of latency. Fast-forward switching immediately forwards a packet after reading the destination address. Because fast-forward switching starts forwarding before the entire packet has been received, there may be times when packets are relayed with errors. This occurs infrequently, and the destination network adapter discards the faulty packet upon receipt. In fast-forward mode, latency is measured from the first bit received to the first bit transmitted. Fast-forward switching is the typical cut-through method of switching.

Explain fast-forward switching.

In fragment-free switching, the switch stores the first 64 bytes of the frame before forwarding. The reason is that most network errors and collisions occur during the first 64 bytes. Fragment-free switching tries to enhance fast-forward switching by performing a small error check on the first 64 bytes of the frame to ensure that a collision has not occurred before forwarding the frame. Fragment-free switching is a compromise between the high latency and high integrity of store-and-forward switching, and the low latency and reduced integrity of fast-forward switching.

Explain fragment-free switching.

In CSMA/CA, the device examines the media for the presence of a data signal. If the media is free, the device sends a notification across the media of its intent to use it. The device then sends the data.

Explain how CSMA/Collision Avoidance operates.

In CSMA/CD, the device monitors the media for the presence of a data signal. If a data signal is absent, indicating that the media is free, the device transmits the data.

Explain how CSMA/Collision Detection operates.

When the auto-MDIX feature is enabled, the switch detects the required cable type for copper Ethernet connections and configures the interfaces accordingly. Therefore, you can use either a crossover or a straight-through cable for connections to a copper 10/100/1000 port on the switch, regardless of the type of device on the other end of the connection.

Explain in detail what the Auto-MDIX feature does.

When the switch receives the frame, it stores the data in buffers until the complete frame has been received. During the storage process, the switch analyzes the frame for information about its destination. In this process, the switch also performs an error check using the CRC trailer portion of the Ethernet frame. After confirming the integrity of the frame, the frame is forwarded out the appropriate port toward its destination. If an error is detected, it discards the frame.

Explain store-and-forward switching.

Any frame less than 64 bytes in length is considered a collision fragment or runt frame and is automatically discarded by receiving stations.

Explain what a "collision fragment" or "runt frame" is and what happens to it on the network.

The multicast MAC address is a special value that begins with 01-00-5E in hexadecimal.

How are multicast addresses different than unicast or broadcast addresses?

The source node needs to deliver the frame to the router interface that is the gateway or next hop used to reach that destination. The source node will use the MAC address of the gateway as the destination address.

If the destination IPv4 host is on the local network, the frame will use the MAC address of this device as the destination MAC address. If the destination IPv4 host is not on the local network, what happens?

1. The full option sets full-duplex mode, where data flow is bidirectional. 2. The half option sets half-duplex mode, where data flow is unidirectional. 3. The auto option set autonegotiation of duplex mode. With autonegotiation enabled, the two ports communicate to decide the best mode of operation.

List and explain the three duplex settings supported by a Cisco Catalyst switch.

An increase in network overhead - If a large number of devices were powered up and all start accessing network services at the same time, there could be some reduction in performance for a short period of time. A decrease in network security - Spoofing is a technique used by an attacker to inject the wrong MAC address association into a network by issuing fake ARP requests. An attacker forges the MAC address of a device, and then frames can be sent to the wrong destination.

List and explain two potential issues with ARP.

Preamble - 4 bytes Start of frame delimiter - 1 byte Destination MAC Address - 6 bytes Source MAC Address - 6 bytes Length - 2 bytes Header and data - 46 to 1500 bytes Frame check sequence - 4 bytes

List the primary fields in an Ethernet frame.

EtherChannel

Logical interface on a Cisco device associated with a bundle of routed ports in order to aggregate bandwidth.

ARP table

Logical storage in a host's RAM to store ARP entries. Also called ARP cache.

CSMA/Collision Detection (CSMA/CD)

Media-access mechanism that requires a node wishing transmit to listen for a carrier signal before trying to send. If a carrier is sensed, the node waits for the transmission in progress to finish before initiating its own transmission. If a collision occurs and is detected, the sending node uses the backoff algorithm before retransmitting.

Carrier Sense Multiple Access (CSMA)

Media-access mechanism wherein devices ready to transmit data first check the channel for a carrier. If no carrier is sensed for a specific period of time, a device can transmit.

content addressable memory - CAM - table

Memory that is accessed based on its contents, not on its memory address. Also known as associative memory.

cut-through

No error checking on frames is performed by the switch before releasing the frame out of its ports.

gateway

Normally, a relatively general term that refers to different kinds of networking devices. Historically, when routers were created, they were called this.

Preamble

Notifies destinations to get ready for a new frame

1. The switch receives a broadcast frame from PC1 on Port 1. 2. The switch enters the source MAC address and the switch port that received the frame into the address table. 3. Because the destination address is a broadcast, the switch floods the frame to all ports, except the port on which it received the frame. 4. The destination device replies to the broadcast with a unicast frame addressed to PC1. 5. The switch enters the source MAC address of PC2 and the port number of the switch port that received the frame not in the address table. The destination address of the frame and its associated port are found in the MAC address table. 6. The switch can now forward frames between source and destination devices without flooding, because it has the entries in the address table that identify the associated ports.

Number in sequence, the following steps a switch takes to build its MAC address table and correctly forward frames.

On Ethernet networks, the broadcast MAC address is 48 1s displayed as hexdecimal FF-FF-FF-FF-FF-FF.

On Ethernet networks, how is the broadcast MAC address displayed in hexadecimal?

On a Windows host, the ipconfig /all command can be used to identify the MAC address of an Ethernet adapter.

On a Windows host, what command can be used to identify the MAC address of an Ethernet adapter?

MAC address table

On a switch, a table that lists all known MAC addresses, and the bridge/switch port out that the bridge/switch should use to forward frames sent to each MAC address.

LLC

Remains relatively independent of physical equipment.

Switch Form-Factor Pluggable - SFP

Removable modules used in routers and switches to support a number of different network media.

overhead

Resources used to manage or operate the network. It consumes bandwidth and reduces the amount of application data that can be transported across the network.

MAC

Supports Ethernet technology by using CSMA/CD or CSMA/CA.

Start of frame delimiter

Synchronizes sending and receiving devices for frame delivery

All MAC addresses assigned to a NIC or other Ethernet device must use that vendor's assigned OUI as the first 3 bytes. All MAC addresses with the same OUI must be assigned a unique value (vendor code or serial number) in the last 3 bytes.

The IEEE requires vendors to follow two simple rules. These are:

CAM, content addressable

The MAC address table is sometimes referred to as a _____ table because it is stored in _____ memory.

The MAC address table is sometimes referred to as a content addressable memory (CAM) table.

The MAC address table is sometimes referred to as a what?

One way is to monitor the traffic that occurs on the local network segment. As a node receives frames from the media, it can record the source IP and MAC address as a mapping in the ARP table. As frames are transmitted on the network, the device populates the ARP table with address pairs. Another way a device can get an address pair is to send an ARP request. An ARP request is a Layer 2 broadcast to all devices on the Ethernet LAN. The ARP request contains the IP address of the destination host and the broadcast MAC address. The node with the IP address that matches the IP address in the ARP request will reply, this is used to make a new entry in the ARP table of the sending node.

There are two ways that a device can gather MAC addresses. Explain both.

no switchport, IP

To configure a router port, the interface must be put into Layer 3 mode by using the _____ interface configuration command. After this, the interface must be assigned an _____ address.

duplex

Two types of settings used for communications on networks: half duplex and full duplex. Half-duplex communication relies on unidirectional data flow where sending and receiving data are not performed at the same time. In full-duplex communication, data flow is bidirectional, so data can be sent and received at the same time.

802.2 Header and Data

Uses Pad to increase this frame field to at least 64 bytes

minimum: 64 bytes maximum: 1518 bytes

What are the minimum and the maximum frame sizes as defined by Ethernet II and IEEE 802.3?

The Ethernet MAC layer has two primary responsibilities: data encapsulation and media access control. Frame delimination, addressing, and error detection are part of data encapsulation Media recovery and media access are part of CSMA/CD.

What are the primary functions associated with data encapsulation at the Ethernet MAC sublayer?

Resolving IPv4 addresses to MAC addresses Maintaining a table of mappings

What are the two basic functions of the ARP protocol?

arp -a

What command is used in Windows 7 to display the ARP table?

show ip arp

What command is used on a Cisco router to display the ARP table?

The 10/100/1000 ports operate in either half- or full-duplex mode when they are set to 10 or 100 Mbps, but when set to 1000 Mbps, they operate only in full-duplex mode.

What duplex setting is required when using 1000Mb/s speeds?

The ARP process resolves IPv4 address to MAC addresses and maintains a table of these mappings.

What functions are provided by the ARP process?

If the size of a transmitted frame is less than the minimum or greater than the maximum, the receiving device drops the frame.

What happens to frames that are larger than the maximum size?

Ethernet uses CSMA/CD. When a collision is detected on the media, all devices stop transmitting to allow the collision to clear. After the collision has cleared, devices will again attempt to transmit.

What happens when a data collision occurs on an Ethernet bus?

A unicast MAC address is the unique address used when a frame is sent from a single transmitting device to a single destination device.

What is a unicast MAC address?

The range of IPv4 multicast addresses is 224.0.0.0 to 239.255.255.255.

What is the IPv4 address range for multicast addresses?

The IEEE 802.3 standard defines a minimum frame size of 64 bytes and a maximum frame size of 1518 bytes. The IEEE 802.3ac standard released in 1998 extended the maximum size to 1522 bytes to allow the inclusion of an 802.1q VLAN tag in the Ethernet frame.

What is the minimum and maximum Ethernet frame size as defined by IEEE 802.3?

The MAC sublayer is part of the OSI data link layer. The frame is the data layer PDU. Segments are associated with the transport layer, packets with the network layer, and bits with the physical layer.

What is the name given to the Ethernet MAC sublayer PDU?

The LLC sublayer takes the network protocol data, which is typically an IPv4 packet, and adds control information to help deliver the packet to the destination node. The LLC is used to communicate with the upper layers of the application, and transition the packet to the lower layers for delivery.

What is the purpose of the LLC sublayer?

MAC is implemented by hardware, typically in the computer NIC. It encapsulated the frames and sets the controls for media access.

What is the purpose of the MAC sublayer?

The Ethernet MAC address is 48 bits in length with the first 3 bytes - 6 hexadecimal digits - assigned by the IEEE. The vendor is responsible for assigning the last 24 bits in the address. Because this address was permanently configured on a device, it is also known as burned-in address, or BIA.

What is true about the Ethernet MAC address?

Both an SVI and a Layer 3 EtherChannel port are logical interfaces. A router port is a physical interface that has had Layer 2 functionality shut down in favor of Layer 3 functionality.

What name is given to a physical port on a Layer 3 switch configured to act as a router port?

The sole forwarding method used on Cisco switches is store-and-forward. This is required where frame classification for traffic prioritization (QoS) is necessary.

What type of switching is used on current L2 switches to allow QoS?

ARP table or ARP cache, request

When ARP receives a request to map an IPv4 address to a MAC address, it first looks in its _____. If no entry is found, ARP will send out an ARP _____.

source, drop

When a device receives an ARP request for a device with a different IP address, it will use the _____ information to update its ARP table and then it will _____ the packet.

MAC address table, floods, received

When a switch receives a broadcast frame, it enters the source information in its _____ and then it _____ the frame to all ports except the one the frame was _____ on.

All multicast MAC addresses start with 01-00-5E.

Which address is a multicast address?

The broadcast address is when all 48 bits are turned on and is represented by FF-FF-FF-FF-FF-FF.

Which address is used as a destination address on a broadcast Ethernet frame?

ARP requests are sent out with a broadcast MAC address. All devices in the L2 broadcast domain will hear the request and use the information it contains to update their ARP tables with information for the source device.

Which devices on a network will hear an ARP request?

The Frame Check Sequence field is used to detect frames that might have been damaged in transit.

Which field in an Ethernet frame is used for error detection?

IEEE 802.2

Which standard specifies the Ethernet MAC sublayer functionality in a computer NIC?

To prevent the excessive overhead involved in the processing of every frame, a unique identifier called a MAC address was created to identify the actual source and destination nodes within an Ethernet network. Regardless of which variety of Ethernet was used, MAC addressing provided a method for device identification at the lower level of the OSI model.

Why were MAC addresses created?

MAC

Works with hardware to support bandwidth requirements and checks errors in the bits sent and received.

LLC

Works with the upper layers to add application information for delivery of data to higher level protocols.