CCNA 1 - Chapter 5

The binary number 0000 1010 can be expressed as ____ in hexadecimal

A

As shown in the figure, the Ethernet MAC sublayer has two primary responsibilities

Data encapsulation Media access control

What happens to runt frames received by a Cisco Ethernet switch?

The frame is dropped.

ARP Spoofing

technique used by an attacker to reply to an ARP request for an IPv4 address belonging to another device, such as the default gateway. The attacker sends an ARP reply with its own MAC address. The receiver of the ARP reply will add the wrong MAC address to its ARP table and send these packets to the attacker.

Media Access Control

Media access control is responsible for the placement of frames on the media and the removal of frames from the media. As its name implies, it controls access to the media. This sublayer communicates directly with the physical layer.

ARP provides two basic functions

Resolving IPv4 addresses to MAC addresses Maintaining a table of mappings

ARP messages

encapsulated directly within an Ethernet frame. There is no IPv4 header. The ARP request message includes: Target IPv4 address - This is the IPv4 address that requires a corresponding MAC address. Target MAC address - This is the unknown MAC address and will be empty in the ARP request message.

Match the 7 fields of an Ethernet frame to their respective contents. (Not all options are used.) What is beginning of frame- field 1?

field 1: preamble

Match the 7 fields of an Ethernet frame to their respective contents. (Not all options are used.) What is field 2?

field 2: Start Frame Delimiter

Match the 7 fields of an Ethernet frame to their respective contents. (Not all options are used.) What is field 3?

field 3: Destination MAC Address

Match the 7 fields of an Ethernet frame to their respective contents. (Not all options are used.) What is field 4?

field 4: Source MAC Address

Match the 7 fields of an Ethernet frame to their respective contents. (Not all options are used.) What is field 5?

field 5: Length/Type

Match the 7 fields of an Ethernet frame to their respective contents. (Not all options are used.) What is field 6?

field 6: Encapsulated Data

Which switching method uses the CRC value in a frame?

store-and-forward

Physical address (the MAC address)

Used for Ethernet NIC to Ethernet NIC communications on the same network.

What is the Layer 2 multicast MAC address that corresponds to the layer 3 IPv4 multicast address 224.139.34.56

01-00-5E-0B-22-38

Logical address (the IP address)

Used to send the packet from the original source to the final destination.

What are the two sizes (minimum and maximum) of an Ethernet frame? (Choose two.) 56 bytes 64 bytes 128 bytes 1024 bytes 1518 bytes

64 bytes 1518 bytes

IEEE requires a vendor to follow two simple rules

All MAC addresses assigned to a NIC or other Ethernet device must use that vendor's assigned OUI as the first 3 bytes. All MAC addresses with the same OUI must be assigned a unique value in the last 3 bytes.

What statement illustrates a drawback of the CSMA/CD access method?

Collisions can decrease network performance.

The ARP request is encapsulated in an Ethernet frame using:

Destination MAC address - This is a broadcast address requiring all Ethernet NICs on the LAN to accept and process the ARP request. Source MAC address - This is the sender of the ARP request's MAC address. Type - ARP messages have a type field of 0x806. This informs the receiving NIC that the data portion of the frame needs to be passed to the ARP process.

the Layer 2 Ethernet frame contains

Destination MAC address - This is the MAC address of the file server's Ethernet NIC. Source MAC address - This is the MAC address of PC-A's Ethernet NIC.

The ARP reply is encapsulated in an Ethernet frame using the following header information:

Destination MAC address - This is the MAC address of the sender of the ARP request. Source MAC address - This is the sender of the ARP reply's MAC address. Type - ARP messages have a type field of 0x806. This informs the receiving NIC that the data portion of the frame needs to be passed to the ARP process If no device responds to the ARP request, the packet is dropped because a frame cannot be created.

Which two statements are correct about MAC and IP addresses during data transmission if NAT is not involved? (Choose two.) Destination MAC addresses will never change in a frame that goes across seven routers. A packet that has crossed four routers has changed the destination IP address four times Destination and source MAC addresses have local significance and change every time a frame goes from one LAN to another Destination IP addresses in a packet header remain constant along the entire path to a target host.

Destination and source MAC addresses have local significance and change every time a frame goes from one LAN to another Destination IP addresses in a packet header remain constant along the entire path to a target host.

Match the 7 fields of an Ethernet frame to their respective contents. (Not all options are used.) What is field 7?

End of frame-Field 7: Frame Check Sequence

Which destination address is used in an ARP request frame?

FFFF.FFFF.FFFF

two variants of cut-through switching

Fast-forward switching - Fast-forward switching offers the lowest level of latency. Fast-forward switching immediately forwards a packet after reading the destination address. fragment-free switching - In fragment-free switching, the switch stores the first 64 bytes of the frame before forwarding. Fragment-free switching can be viewed as a compromise between store-and-forward switching and fast-forward switching. The reason fragment-free switching stores only the first 64 bytes of the frame is that most network errors and collisions occur during the first 64 bytes.

Data encapsulation provides three primary functions

Frame delimiting - The framing process provides important delimiters that are used to identify a group of bits that make up a frame. These delimiting bits provide synchronization between the transmitting and receiving nodes. Addressing - The encapsulation process contains the Layer 3 PDU and also provides for data link layer addressing. Error detection - Each frame contains a trailer used to detect any errors in transmissions.

Refer to the exhibit. A switch with a default configuration connects four hosts. The ARP table for host A is shown. What happens when host A wants to send an IP packet to host D? switch 1 connected to PC A (10.55.5.8) PC B (10.55.5.9) PC C (10.55.5.10) PC D (10.55.5.11) ARP Table Host A Internet Address 10.55.5.9 10.55.5.10 Physical Address AA:AA:AA:AA:AA:AA BB:BB:BB:BB:BB:BB Type dynamic dynamic

Host A sends out a broadcast of FF:FF:FF:FF:FF:FF. Every other host connected to the switch receives the broadcast and host D responds with its MAC address.

What are two features of ARP? (Choose two.) If a host is ready to send a packet to a local destination device and it has the IP address but not the MAC address of the destination, it generates an ARP broadcast. An ARP request is sent to all devices on the Ethernet LAN and contains the IP address of the destination host and its multicast MAC address. When a host is encapsulating a packet into a frame, it refers to the MAC address table to determine the mapping of IP addresses to MAC addresses. If a device receiving an ARP request has the destination IPv4 address, it responds with an ARP reply. If no device responds to the ARP request, then the originating node will broadcast the data packet to all devices on the network segment.

If a host is ready to send a packet to a local destination device and it has the IP address but not the MAC address of the destination, it generates an ARP broadcast.* If a device receiving an ARP request has the destination IPv4 address, it responds with an ARP reply.*

show ip arp

used to display the ARP table

sending device will search its ARP table for a destination IPv4 address and a corresponding MAC address:

If the packet's destination IPv4 address is on the same network as the source IPv4 address, the device will search the ARP table for the destination IPv4 address. If the destination IPv4 address is on a different network than the source IPv4 address, the device will search the ARP table for the IPv4 address of the default gateway. If the device locates the IPv4 address, its corresponding MAC address is used as the destination MAC address in the frame. If there is no entry is found, then the device sends an ARP request.

Cut-Through Switching

In cut-through switching, the switch acts upon the data as soon as it is received, even if the transmission is not complete. The switch buffers just enough of the frame to read the destination MAC address so that it can determine to which port to forward the data. The destination MAC address is located in the first 6 bytes of the frame following the preamble. The switch looks up the destination MAC address in its switching table, determines the outgoing interface port, and forwards the frame onto its destination through the designated switch port. The switch does not perform any error checking on the frame.

What statement describes Ethernet?

It defines the most common LAN type in the world.

What is a characteristic of a contention-based access method?

It is a nondeterministic method

A host is trying to send a packet to a device on a remote LAN segment, but there are currently no mappings in its ARP cache. How will the device obtain a destination MAC address?

It will send an ARP request for the MAC address of the default gateway.

The ARP table in a switch maps which two types of address together?

Layer 3 address to a Layer 2 address

Which two statements describe features or functions of the logical link control sublayer in Ethernet standards? (choose two) Logical link control is implemented in software. The LLC sublayer interacts directly with the NIC driver software. The data link later uses LLC to communicate with the upper layers of the protocol suite. The LLC sublayer is responsible for the placement and retrieval of frames on and off the media. Logical link control is specified in the IEEE 802.3 standard.

Logical link control is implemented in software The data link layer uses LLC to communicate with the upper layers of the protocol suite.

Which two statements describe features or functions of the logical link control sublayer in Ethernet standards? (Choose two.) Logical link control is implemented in software Logical link control is specified in the IEEE 802.3 standard. The LLC sublayer adds a header and a trailer to the data The data link layer uses LLC to communicate with the upper layers of the protocol suite The LLC sublayer is responsible for the placement and retrieval of frames on and off of the media

Logical link control is implemented in software. The data link layer uses LLC to communicate with the upper layers of the protocol suite.

Which address or combination of addresses does a Layer 3 switch use to make forwarding decisions?

MAC and IP addresses

A collision fragment, also known as a __________________ frame, is a frame of fewer than 64 bytes in length.

RUNT

What are two potential network problems that can result from ARP operation? Choose two. Manually configuring static ARP associations could facilitate ARP poisoning or MAC address spoofing. On large networks with low bandwidth, multiple ARP broadcasts could cause data communication delays. Network attackers could manipulate MAC address and IP address mappings in ARP messages with the intent of intercepting network traffic Large numbers of ARP request broadcasts could cause the host MAC address table to overflow and prevent the host from communicating on the network. Multiple ARP replies result in the switch MAC address table containing entries that match the MAC addresses of hosts that are connected to the relevant switch port.

On large networks with low bandwidth, multiple ARP broadcasts could cause data communication delays. Network attackers could manipulate MAC address and IP address mappings in ARP messages with the intent of intercepting network traffic.

Duplex Mismatch

One of the most common causes of performance issues on 10/100 Mb/s Ethernet links occurs when one port on the link operates at half-duplex while the other port operates at full-duplex, as shown in Figure 2. This occurs when one or both ports on a link are reset, and the autonegotiation process does not result in both link partners having the same configuration. It also can occur when users reconfigure one side of a link and forget to reconfigure the other. Both sides of a link should have autonegotiation on, or both sides should have it off.

Refer to the exhibit. PC1 issues an ARP request because it needs to send a packet to PC2. In this scenario, what will happen next? PC1 (Fa0/1) Connected to SW1 PC2 (Fa0/2) Connected to SW1 SW1 (Fa 0/3) (Fa 0/0) Connected to Router 1 (Fa 0/1) (Fa 0/2) Connected to SW2 SW2 (Fa 0/1) Connected to PC3

PC will send an ARP reply with its MAC address.

On a Cisco switch, __________-________________ memory buffering is used to buffer frames in queues linked to specific incoming and outgoing ports.

Port-Based

Memory Buffering on Switches

Port-based Memory Buffering - frames are stored in queues that are linked to specific incoming and outgoing ports. A frame is transmitted to the outgoing port only when all the frames ahead of it in the queue have been successfully transmitted. It is possible for a single frame to delay the transmission of all the frames in memory because of a busy destination port. This delay occurs even if the other frames could be transmitted to open destination ports. Shared memory buffering - deposits all frames into a common memory buffer that all the ports on the switch share. The amount of buffer memory required by a port is dynamically allocated. The frames in the buffer are linked dynamically to the destination port. This allows the packet to be received on one port and then transmitted on another port, without moving it to a different queue.

The ARP reply message includes:

Sender's IPv4 address - This is the IPv4 address of the sender, the device whose MAC address was requested. Sender's MAC address - This is the MAC address of the sender, the MAC address needed by the sender of the ARP request.

The Layer 3 IP packet contains

Source IP address - This is the IP address of the original source, PC-A. Destination IP address - This is the IP address of the final destination, the file server.

ARP ________________________ is a technique that is used to send fake ARP messages to other hosts in the LAN. The aim is associate IP addresses to the wrong MAC addresses.

Spoofing

Switches use one of the following forwarding methods for switching data between network ports

Store-and-forward switching Cut-through switching - Cut-through switching is the predominant switching method used on Cisco switches.

oui

The IEEE assigns the vendor a 3-byte (24-bit) code, called the Organizationally Unique Identifier (OUI).

A network administrator is connecting two modern switches using a straight-through cable. The switches are new and have never been configured. Which three statements are correct about the final result of the connection? (Choose three.) The auto-MDIX feature will configure the interfaces eliminating the need for a crossover cable. The connection will not be possible unless the administrator changes the cable to a crossover cable. The duplex capability has to be manually configured because it cannot be negotiated. If both switches support different speeds, they will each work at their own fastest speed. The link between switches will work as full-duplex. The link between the switches will work at the fastest speed that is supported by both switches.

The auto-MDIX feature will configure the interfaces eliminating the need for a crossover cable. The link between switches will work as full-duplex. The link between the switches will work at the fastest speed that is supported by both switches.

Which statement is true about MAC addresses?

The first three bytes are used by the vendor assigned OUI

Learning MAC Addresses

The switch dynamically builds the MAC address table by examining the source MAC address of the frames received on a port. The switch forwards frames by searching for a match between the destination MAC address in the frame and an entry in the MAC address table. If the destination MAC address is in the table, it will forward the frame out the specified port If the destination MAC address is not in the table, the switch will forward the frame out all ports except the incoming port. This is known as an unknown unicast.

Refer to the exhibit. The exhibit shows a small switched network and the contents of the MAC address table of the switch. PC1 has sent a frame addressed to PC3. What will the switch do with the frame? MAC Address Table Port 1: MAC Address :12-34-56-78-9A-BF Port 3: MAC Address: 12-34-56-78-9a-BD PC1: 12-34-56-78-9A-BF PC2: 12-34-56-78-9A BD PC3: 12-34-56-78-9A-BE PC4: 12-34-56-78-9A-BF

The switch will forward the frame to all ports except port 4.

Which statement describes the treatment of ARP requests on the local link?

They are received and processed by every device on the local network

What statement describes a characteristic of MAC addresses?

They must be globally unique.

True or False? When a device is sending data to another device on a remote network, the Ethernet frame is sent to the MAC address of the default gateway.

True

Resolving IPv4 Addresses to MAC Addresses

When a packet is sent to the data link layer to be encapsulated into an Ethernet frame, the device refers to a table in its memory to find the MAC address that is mapped to the IPv4 address. This table is called the ARP table or the ARP cache. The ARP table is stored in the RAM of the device.

Auto-MDIX

When the auto-MDIX feature is enabled, the switch detects the type of cable attached to the port, and configures the interfaces accordingly. Therefore, you can use either a crossover or a straight-through cable for connections to a copper 10/100/1000 port on the switch, regardless of the type of device on the other end of the connection.

What is auto-MDIX

a feature that detects Ethernet cable type

A network administrator issues the following commands on a Layer 3 switch: DLS1(config)# interface f0/3 DLS1(config-if)#no switchport DLS1(config-if)#ip address 172.16.0.1 255.255.255.0 What is the administrator configuring?

a routed port

Match the characteristic to the forwarding method store-and-forward

always stores the entire frame checks the CRC before forwarding checks the frame length before forwarding

Removing Entries from an ARP Table

an ARP cache timer removes ARP entries that have not been used for a specified period of time. The times differ depending on the device's operating system. Commands may also be used to manually remove all or some of the entries in the ARP table. After an entry has been removed, the process for sending an ARP request and receiving an ARP reply must occur again to enter the map in the ARP table.

How does adding an Ethernet line card affect the form factor of a switch?

by expanding the port density

Match the characteristic to the forwarding method. cut-through

has low latency may forward runt frames begins forwarding when the destination address is receied

What is the purpose of the preamble in an Ethernet frame?

is used for timing synchronization

contention-based

means that any device can try to transmit data across the shared medium whenever it has data to send.

ethernet frame size

minimum Ethernet frame size is 64 bytes and the maximum is 1518 bytes

Refer to the exhibit. The switches are in their default configuration. Host A needs to communicate with host D, but host A does not have the MAC address for its default gateway. Which network hosts will receive the ARP request sent by host A? Router 1----Switch---PC A, PC B, PC C Router 1 is connected to Router 2 with (lightning bolt) Router 2---switch---PC D

only hosts B, C and router R1

A Layer 2 switch is used to switch incoming frames from a 1000BASE-T port to a port connected to a 100Base-T network. Which method of memory buffering would work best for this task?

shared memory buffering

What addressing information is recorded by a switch to build its MAC address table?

the source Layer 2 address of incoming frames

On a Windows 7 PC, the arp -a command is used

to display the ARP table

When would a switch record multiple entries for a single switch port in its MAC address table?

when another switch is connected to the switch port

store-and-forward switching

when the switch receives the frame, it stores the data in buffers until the complete frame has been received. During the storage process, the switch analyzes the frame for information about its destination. In this process, the switch also performs an error check using the Cyclic Redundancy Check (CRC) trailer portion of the Ethernet frame. CRC uses a mathematical formula, based on the number of bits (1s) in the frame, to determine whether the received frame has an error. After confirming the integrity of the frame, the frame is forwarded out the appropriate port, toward its destination. When an error is detected in a frame, the switch discards the frame. Discarding frames with errors reduces the amount of bandwidth consumed by corrupt data.