4.2 Ethernet Frames

Question 1

ETHERNET

Answer 1

Ethernet is one of two LAN technologies used today, with the other being wireless LANs (WLANs).
Ethernet uses wired communications, including twisted pair, fiber-optic links, and coaxial cables.

Ethernet operates in the data link layer and the physical layer.
It is a family of networking technologies defined in the IEEE 802.2 and 802.3 standards.

Question 2

LLC Sublayer

Answer 2

Logical Link Control

The LLC sublayer is responsible for controlling the network interface card through software drivers.
The LLC works with upper layers to support higher level protocols.

This IEEE 802.2 sublayer communicates between the networking software at the upper layers and the device hardware at the lower layers.
It places information in the frame that identifies which network layer protocol is being used for the frame.
This information allows multiple Layer 3 protocols, such as IPv4 and IPv6, to use the same network interface and media.

Question 3

MAC Sublayer

Answer 3

Media Access Control

The MAC sublayer checks for bit errors, supports Ethernet technologies, and controls access to the media.

This sublayer (IEEE 802.3, 802.11, or 802.15 for example) is implemented in hardware and is responsible for data encapsulation and media access control.
It provides data link layer addressing and is integrated with various physical layer technologies.

The MAC sublayer is responsible for data encapsulation and accessing the media.

Question 4

DATA ENCAPSULATION

Answer 4

IEEE 802.3 data encapsulation includes the following:

• Ethernet frame: This is the internal structure of the Ethernet frame.
• Ethernet Addressing: The Ethernet frame includes both a source and destination MAC address to deliver the
  Ethernet frame from Ethernet NIC to Ethernet NIC on the same LAN.
• Ethernet Error detection: The Ethernet frame includes a frame check sequence (FCS) trailer used for error
  detection.

Question 5

ACCESSING THE MEDIA

Answer 5

IEEE 802.3 MAC sublayer includes the specifications for different Ethernet communications standards over various types of media including copper and fiber.

Question 6

CSMA/CD

Answer 6

Carrier Sense Multiple Access/Collision Detection

Ethernet over a half-duplex medium uses a contention-based access method, carrier sense multiple access/collision detection (CSMA/CD).
This ensures that only one device is transmitting at a time.
CSMA/CD allows multiple devices to share the same half-duplex medium, detecting a collision when more than one device attempts to transmit simultaneously.
It also provides a back-off algorithm for retransmission.

Ethernet LANs of today use switches that operate in full-duplex.
Full-duplex communications with Ethernet switches do not require access control through CSMA/CD.

Question 7

ETHERNET FRAME

Question 8

ETHERNET FRAME

Answer 8

The minimum Ethernet frame size is 64 bytes and the expected maximum is 1518 bytes.
This includes all bytes from the destination MAC address field through the frame check sequence (FCS) field.
The preamble field is not included when describing the size of the frame.

Any frame less than 64 bytes in length is considered a “collision fragment” or “runt frame” and is automatically discarded by receiving stations.
Frames with more than 1500 bytes of data are considered “jumbo” or “baby giant frames”.

If the size of a transmitted frame is less than the minimum, or greater than the maximum, the receiving device drops the frame.

Question 9

ETHERNET FRAME FIELDS

Answer 9

1 Preamble and SFD
2 Destination MAC Address
3 Source MAC Address
4 Type / Length
5 Data
6 FCS

Question 10

1 PREAMBLE and SFD

Answer 10

The PREAMBLE (7 bytes) and Start Frame Delimiter (1 byte) fields are used for synchronization between the sending and receiving devices.
These first 8 bytes of the frame are used to get attention of the receiving nodes.
Essentially, the first 8 bytes tell the receivers to get ready to receive a new frame.

Question 11

2 DESTINATION MAC Address Field

Answer 11

This 6 bytes field is the identifier for the intended recipient.
This address is used by layer 2 to assist devices in determining if a frame is addressed to them.
The address in the frame is compared to the MAC address in the device, if there is a match, the device accepts the frame.
It can be a UNICAST, MULTICAST or BROADCAST address.

Question 12

3 SOURCE MAC ADDRESS FIELD

Answer 12

This 6 bytes field identifies the originating NIC or interface of the frame.

Question 13

4 TYPE / LENGHT

Answer 13

This 2 bytes field identifies the upper layer protocol encapsulated in the Ethernet frame.

Question 14

5 DATA FIELD

Answer 14

This field (46 - 1500 bytes) contains the encapsulated data from a higher layer, which is a generic Layer 3 PDU or more commonly, an IPv4 packet.
All frames must be at least 64 bytes long.
If a small packet is encapsulated, additional bits called a PAD are used to increase the size of the frame to this minimum size.

Question 15

6 FRAME CHECK SEQUENCE

Answer 15

The Frame Check Sequence field (4 bytes) is used to detect errors in a frame.
It uses a CYCLIC REDUNDANCY CHECK (CRC).
The sending device includes the results of a CRC in the FCS field of the frame.
The receiving device receives the frame and generates a CRC to look for errors.
If the calculations match, no error occurred.
Calculations that do not match are an indication that the data has changed, therefore the frame is dropped.
A change in the data could be the result of a disruption of the electrical signals that represent the bits.

Question 16

ARP

Answer 16

Address Resolution Protocol (ARP) is used by TCP/IP to map a Layer 3 IPv4 address to a Layer 2 MAC address. When an Ethernet frame is transmitted on the network, it must have a destination MAC address.
To dynamically discover the MAC address of a known destination, the source device broadcasts an ARP request on the local network.
The device that is configured with the destination IPv4 address responds to the request with an ARP reply and the MAC address is recorded in the ARP cache.

Question 17

ARP Cache

Answer 17

Every device on the LAN maintains its own ARP cache.
The ARP cache is a small area in RAM that holds the ARP responses.
Viewing an ARP cache on a PC displays the IPv4 address and the MAC address of each device on the LAN with which the PC has exchanged ARP messages.