Chapter 5 - Ethernet Flashcards

1
Q

What is the most widely used LAN technology today?

A

Ethernet

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

What layers does Ethernet operate in?

A

The data link layer and the physical layer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What standards define Ethernet?

A

IEEE 802.2 and 802.3 standards.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What bandwidths does Ethernet support?

A
  • 10Mb/s
  • 100Mb/s
  • 1000Mb/s (1Gb/s)
  • 10,000Mb/s (10Gb/s)
  • 40,000Mb/s (40Gb/s)
  • 100,000Mb/s (100Gb/s)
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

What does the Ethernet LLC sublayer do?

A

It handles the communication between the upper layers and the lower layers. This is typically between the networking software and the device hardware. It takes the network protocol data, and adds control information to help deliver the packet to the destination node.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

Where is the LLC sublayer implemented?

A

In software, independent of the hardware. In a computer, the LLC can be considered the driver software for the NIC. The NIC driver is a program that interacts directly with the hardware to pass the data between the MAC sublayer and the physical media.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

Where is the MAC sublayer implemented?

A

It’s implemented by hardware, typically in the computer NIC.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

What are the primary responsibilities of the Ethernet MAC sublayer?

A

Data encapsulation & Media Access Control

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

What is data encapsulation?

A

The process includes frame assembly before transmission, and frame disassembly upon reception of a frame. In forming the frame, the MAC layer adds a header and trailer to the network layer PDU. The use of frames aids in the transmission of bits as they are placed on the media and in the grouping of bits at the receiving node.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What are the primary functions of data encapsulation?

A

Frame delimiting, addressing, error detection

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is frame delimiting?

A

The framing process provides important delimiters that are used to identify a group of bits that make up a frame. These bits provide synchronization between the transmitting and receiving nodes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What is addressing?

A

The encapsulation process contains the Layer 3 PDU and also provides for data link layer addressing

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What is error detection?

A

Each frame contains a trailer used to detect any errors in transmission.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

What is Media Access Control?

A

Media access control is responsible for the placement of frames on the media and the removal of frames from the media. This sublayer communicates directly with the physical layer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

What is the logical topology of Ethernet and what does that mean?

A

The underlying logical topology of Ethernet is a multi-access bus; therefore, all nodes on a single network segment share the medium. As Ethernet is a contention-based method of networking, any device can try to transmit data across the shared medium whenever it has data to send.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What process is used in half-duplex Ethernet LANs to prevent colissions?

A

Carrier Sense Multiple Access/Collision Detection (CSMA/CD)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

What is one of the reasons Ethernet has become so popular?

A

It’s ability to improve over time. Early versions were relatively slow at 10Mbps. The latest versions operate at 10 Gigabits per second and faster.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

What is the minimum and maximum ethernet frame size?`

A

64 bytes, and 1518 bytes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What are frames that are too big or too small called? What happens to them?

A

If the size of the frame is less than the minimum it is called a “collision fragment” or a “runt frame”. Frames bigger than 1500 bytes are called “jumbo” or “baby giant frames”. If the size is too big or too small the receiving device drops the frame.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What are the fields in the Ethernet frame?

A

Preamble and Start Frame Delimiter, Destination MAC Address, Source MAC Address, EtherType, Data, Frame Check Sequence Field (FCS)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What are the preamble and start frame delimiter fields?

A

The Preamble (7 bytes) and Start Frame Delimiter (SFD), also called the Start of Frame (1 byte), fields are used for synchronization between the sending and receiving devices. These first eight bytes are used to inform the receiving device that a new frame is coming.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

What is the destination MAC address field?

A

This 6-byte field is the identifier for the intended recipient. This address is used by Layer 2 to assist devices in determining if a frame is addressed to them. The address in the frame is compared to the MAC address in the device, and accepted if there is a match. Can be a unicast, multicast, or broadcast address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the source MAC address field?

A

This 6-byte field identifies the frame’s originating NIC or interface. Must be a unicast address.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What is EtherType field?

A

This 2-byte field identifies the upper layer protocol encapsulated in the Ethernet frame. Common values are, in hex, 0x800 for IPv4, 0x86DD for IPv6 and 0x806 for ARP.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

What is the data field?

A

This field (46-1500 bytes) contains the encapsulated data from a higher layer, which is a generic Layer 3 PDU, or more commonly, an IPv4 packet. If a small packet is encapsulated, additional bits called a pad are used to increase the size of the frame to this minimum size.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is the FCS field?

A

The Frame Check Sequence field (4 bytes) is used to detect errors in a frame. It uses a cyclic redundancy check (CRC). The sending device includes the results of a CRC in the FCS field. The receiving device receives the frame and generates a CRC to look for errors. If the calculations match, no error occured. If not, the data has changed and the frame is dropped.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

What is an Ethernet MAC address?

A

A 48-bit binary value express as 12 hexadecimal digits (4 bits per digit).

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is hexadecimal?

A

The base-16 numbering system. Uses the numbers 0 to 9 and the letter A to F.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

How is hexadecimal represented?

A

Usually represented by the value preceded by 0x (ex: 0x73) or with a subscribt 16. Less commonly, it may be followed by an H (ex: 73H) However, since subscript text is not recognized in command line or programming environments, the technical representation is preceded with “0x”.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

What are the rules of the MAC address structure, and who enforces these rules? What is the OUI?

A

The MAC address value is a direct result of IEEE-enforced rules to ensure globally unique addresses for each Ethernet device. The IEEE requires any vendor that sells ether devices register with the IEEE. The IEEE then assigns the vendor a 3-byte (24-bit) code called the Organizationally Unique Identifier (OUI). All Mac addresses assigned to a NIC or other Ethernet device must use that vendor’s assigned OUI as the first 3 bytes. All MAC addresses with the same OUI must be assigned a unique value in the last 3 bytes.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What does BIA mean?

A

Burned-in address, a different name for MAC address because, historically, this address is burned into ROM (Read-Only memory) on the NIC.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What is the first thing the NIC does when a computer starts up?

A

Copies the MAC address from ROM into RAM.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What happens when a NIC receives an Ethernet frame?

A

It examines the destination MAC address to see if it matches the device’s physical MAC address stored in RAM. If there is no match, the device discards the frame. If there is a match, it passes the frame up the OSI layers, where the de-encapsulation process takes place. (Note: Ethernet NICs will also accept frames if the destination MAC address is a broadcast or a multicast group of which the host is a member)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

On a Windows host, what command can be used to identify the MAC address of an Ethernet adapter?

A

ipconfig /all

The display will indicate the Physical (MAC) Address of the computer.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

What are the different representations of MAC Addresses?

A

With Dashes: XX-XX-XX-XX-XX-XX
With Colons: XX:XX:XX:XX:XX:XX
With Periods: XXXX.XXXX.XXXX

36
Q

What is a unicast MAC address?

A

The unique address used when a frame is sent from a single transmitting device to a single destination device.

37
Q

What is ARP?

A

Address Resolution Protocol is the process that a source host uses to determine the destination MAC address.

38
Q

What is a broadcast MAC address?

A

A broadcast packet contains a destination IPv4 address that has all ones (1s) in the host portion. This means all hosts on that local network will receive and process the packet. Many network protocols, such as DHCP and ARP, use broadcasts.

39
Q

What is a multicast MAC address?

A

Multicast addresses allow a source device to send a packet to a group of devices. Devices that belong to a multicast group are assigned a multicast group IP address. A few uses of multicast addresses is remote gaming, where many players are connected remotely to the same game, or online classes through video conferencing, where many students are connected to the same class.

The multicast IP address requires a corresponding multicast MAC address to deliver frames on a local network. For an IPv4 address, the multicast MAC address is a special value that begins with 01-00-5E in hexadecimal. The remaining portion is created by converting the lower 23 bits of the IP multicast group address into 6 hexadecimal characters. For an IPv6 address, the address begins with 33-33.

40
Q

How does a switch make its forwarding decisions?

A

A switch is completely unaware of the protocol being carried in the data portion of the frame, such as an IPv4 packet. It’s decisions are based solely on Layer 2 Ethernet MAC Addresses.

It consults a MAC address table of all the connected devices to make a forwarding decision for each frame.

41
Q

What is a CAM?

A

A content addressable memory table, another name for the MAC address table.

42
Q

How is the MAC address table built?

A

The switch dynamically builds the MAC address table by examining the source MAC address of the frames received on a port.

43
Q

What are the processes performed on every frame that enters a switch?

A

Learn and Forward

44
Q

What does the switches learn process entail?

A

The switch will examine the source MAC address and port number. If it is not in the MAC address table, it adds it to the table along with the corresponding port number. If the MAC address does exist the Switch updates the refresh timer for that entry. If the MAC address exists, but on a different port number, the new entry replaces the old one with the more current port number.

45
Q

By default how long do most Ethernet switches keep an entry in the MAC address table?

A

5 minutes. That is to say after 5 minutes without receiving a frame from that device (at which point the refresh timer is reset) the entry is deleted from the table.

46
Q

What does the switches forward process entail?

A

If the destination MAC address is a unicast address, the switch will look for a match between the destination MAC address and a MAC address in the MAC address table. If an entry exists then the information is forwarded to that device on that port. If an entry does not exist the switch will forward the frame out all ports except the incoming port. This is known as an unknown unicast.
If the destination MAC address is a broadcast or a multicast address, the frame is also sent out all ports except the incoming port.

47
Q

Can a switch have multiple MAC addresses associated with a single port? Why or why not?

A

Yes this is common when a switch is connected to another switch. One switch will enter a separate entry for each unique MAC address of every frame received from the other switch, even though the switch is only assigned to one port.

48
Q

What happens when a destination IP address is on a remote network?

A

The Ethernet frame cannot be sent directly to the destination device. Instead, the ethernet frame is sent to the MAC address of the default gateway, the router.

49
Q

Switch 1:
Port 1: PC-A: 00-0A
Port 3: PC-B: 00-0B
Port 4: Switch 2

Switch 2:
Port 1: Switch 1
Port 2: PC-C: 00-0C
Port 4: Router: 00-0D

Router:
Port 1: Switch 2
Port 2: Internet

Given this setup describe what happens, and the state of the switches MAC address tables, when (assume MAC address table is empty to start with):

1) PC-A sends a frame to PC-B
2) PC-B sends a frame to PC-A
3) PC-A sends a frame to a remote network
4) A remote network sends a frame to PC-A.

A
1) PC-A sends it's frame to Switch 1. Switch 1 receives the frame and adds PC-A's MAC address to it's MAC address table. It then consults it's MAC address table to see if the destination MAC address is there. It isn't, so it floods the information out all ports, minus the sending port. Port 3, PC-B, receives the frame and checks the destination MAC address, it matches it's MAC address, so it accepts it. Port 4, Switch 2, receives the frame and adds PC-A's MAC address to it's MAC address table. It consults it's MAC address table to see if the destination MAC address is there. It isn't so it floods it out all ports, minus the sending port. Port 2, PC-C, receives the frame, but it does not match it's MAC address, so it rejects it. Port 4, the router, receives the frame, but it does not match it's MAC address, so it rejects it.
Switch 1 MAC Address Table
00-0A - 1
Switch 2 MAC Address Table
00-0A - 1
2) PC-B sends it's frame to Switch 1. Switch 1 receives the frame and adds PC-B's MAC address to it's MAC address table. It then consults it's MAC address table to see if the destination MAC address is there. It is, so it sends the frame directly to PC-A, on port 1.
Switch 1 MAC Address Table
00-0A - 1
00-0B - 3
Switch 2 MAC Address Table
00-0A - 1
3) PC-A sends it's frame to Switch 1. Switch 1 receives the frame, and since PC-A is already in the MAC address table, it just resets the refresh timer. It then checks for the destination MAC address, which is the router 00-0D. It isn't in there, so it floods it to all ports. Port 3, PC-B, receives the frame, and rejects it because it does not match the MAC address. Port 4, Switch 2, receives the frame, and resets PC-A's refresh timer in it's MAC address table. Since the destination MAC address is not in the table, it floods it to all ports. Port 2, PC-C receives the frame, and rejects it. Port 4, the router, receives the frame and accepts it, as the MAC addresses match.
Switch 1 MAC Address Table
00-0A - 1
00-0B - 3
Switch 2 MAC Address Table
00-0A - 1
4) The router receives the frame to send to PC-A, from the remote network. The frame is sent to Switch 2 over port 1. Switch 2 receives it and adds the router's MAC address to it's MAC address table. It then checks the table to see if the destination MAC address is in there. It is so it sends it directly over port 1, to Switch 1. Switch 1 receives the frame, and adds the router's MAC address to it's MAC address table. It then checks the table to see if the destination MAC address is in there. It is so it sends it directly over port 1, to PC-A. PC-A accepts the frame.   
Switch 1 MAC Address Table
00-0A - 1
00-0B - 3
00-0D - 4
Switch 2 MAC Address Table
00-0A - 1
00-0D - 4
50
Q

What are the methods for switching data between network ports?

A

Store-and-forward switching and cut-through switching

51
Q

What is store-and-forward switching?

A

A store-and-forward switch stores the data in buffers until it receives the entire frame has been received. While storing the data the switch is analyzing the frame for information about its destination. The switch also performs an error check using the Cyclic Redundancy Check (CRC) trailer portion of the frame. If the CRC is valid the frame is forwarded out the proper port(s). If the CRC is invalid the switch discards the frame.

52
Q

How does CRC work?

A

The Cyclic Redundancy Check uses a mathematical formula, based on the number of bits (1s) in the frame, to determine whether the received frame has an error.

53
Q

What is cut-through switching?

A

A cut-through switch acts upon data as soon as it is received, even if the transmission is not complete. The switch buffers just enough of the frame to find the destination MAC address so it can determine where to forward the data. It then forwards the frame through the designated port. No error checking is done.

54
Q

What are the types of cut-through switching?

A

Fast-forward switching and fragment-free switching

55
Q

What is fast-forward switching?

A

The most typical kind of cut-through switching, which offers the lowest level of latency. It immediately forwards a packet after reading the destination address. As the forwarding begins before the entire packet is received there are times when packets have errors. In this case the destination network will discard the faulty packet upon receipt.

56
Q

What is fragment-free switching?

A

In fragment-free switching, a type of cut-through switching, the switch stores the first 64 bytes of the frame before forwarding. Most network errors and collisions occur in the first 64 bytes of a frame. Fragment-free attempts to enhance fast-forward switching by performing a small error check on the first 64 bytes. Fragment-free is a compromise between the low latency, low integrity of fast-forward switching, and the high latency, high integrity of store-and-forward switching.

57
Q

What is buffering? What are the buffering methods?

A

A switch may use a buffering technique to store frames before forwarding them. Buffering may also be used when the destination port is busy due to congestion, allowing the switch to store the frame until it can be transmitted. The kinds of buffering are port-based memory buffering, and shared memory buffering.

58
Q

What is port-based buffering?

A

In port-based memory buffering, frames are stored in queues that are linked to specific incoming and outgoing ports. A frame is only transmitted when all the frames ahead of it in the queue have been successfully transmitted. It’s possible that a single frame could delay the transmission of all the other frames because of a destination port, even if the other frames could be transmitted to open destination ports.

59
Q

What is shared memory buffering?

A

Shared memory buffering puts all the frames into a common memory buffer that all the ports on the switch share. The amount of buffer memory required by a port is dynamically allocated. The frames in the buffer are linked dynamically to the destination port. This allows the packet to be received on one port and then transmitted on another port, without moving to a different queue.

60
Q

What is asymmetric switching?

A

Asymmetric switching allows for different data rates on different ports, which allows more bandwidth to be allocated to certain ports, like a port connected to a server.

61
Q

In shared memory buffering, what limits the number of frames stored in the buffer? What does this mean?

A

The number of frames stored in the buffer is limited by the size of the entire memory buffer, not limited to a single port buffer. This means that larger frames can be transmitted with fewer dropped frames. This is especially important in asymmetric switching.

62
Q

What are the duplex settings used for communications on an Ethernet network? What do they mean?

A

Full-Duplex - Both ends of the connection can send at receive simultaneously
Half-Duplex - Only one end of the connection can send at a time.

63
Q

What is autonegotiation?

A

It enables two devices to automatically exchange information about speed and duplex capabilities. The switch and the connected device will choose the highest performance mode that both devices have the capability for. Full-duplex is chosen if available, along with their highest common bandwidth.

64
Q

What is duplex mismatch? What causes it?

A

One of the most common causes of performance issues is when one port on the link operates at half-duplex, and the other operates at full-duplex. The device with half-duplex will continually experience collisions because the device with full-duplex keeps sending frames any time it has something to send. This mismatch often happens when a device is reset, and the autonegotiation process does not result in both devices having the same configuration. This can also happen when a user configures one side of the link, and not the other.

65
Q

What is auto-MDIX?

A

Most switches now support the mdix auto command in the CLI enable the automatic medium-dependent interface crossover (auto-MDIX) feature. When the auto-MDIX is enabled, the switch detects the type of cable attached to the port and configures the interfaces accordingly. This allows you to use a crossover or a straight-through cable for connections to a copper 10/100/1000 port on the switch, regardless of the kind of device on the other end.

66
Q

What are the primary addresses assigned to a device on an Ethernet LAN? What are their purposes?

A

IP Addresses - Also called the logical address. Used to identify the address of the original source and the final destination. It may be on the same IP network as the source, or may be on a remote network.
MAC Addresses - Also called the physical address. Used to deliver the data link frame with the encapsulated IP packet from one NIC to another NIC on the same network. If the destination IP address is on the same network as the source, the MAC address will be that of the destination device.

67
Q

If the destination IP address is on a remote network, what will the destination MAC address be?

A

The address of the host’s default gateway, often a router with internet connectivity. The frame merely needs to be delivered to the default gateway, and then the default gateway will take care of the rest.

68
Q

When a router receives an Ethernet frame what does it do?

A

It de-encapsulates the Layer 2 information. Using the destination IP address, it determines the next-hop device, and then encapsulates the IP packet in a new data link frame for the outgoing interface. This packet is specifically encapsulated to match the particular data link technology associated with the router, ex: Ethernet.

69
Q

What does ARP stand for, and what 2 functions does it provide?

A

The ARP stands for Address Resolution Protocol. It resolves IPv4 address to MAC addresses, and maintains a table of mappings.

70
Q

What is the ARP table? Where it it stored?

A

Also called the ARP cache, it’s a table in a devices memory that contains the mappings of IPv4 addresses and their corresponding MAC addresses. The ARP table is stored in the devices RAM.

71
Q

What happens with the ARP table when a destination IPv4 entry is on the same network? What happens when it is on an external network?

A

If the destination IPv4 entry is on the same network, it just retrieves the IPv4 address, and the corresponding MAC address. If the destination IPv4 entry is on an external network, the device finds the IPv4, and corresponding MAC address, of the networks default gateway.

72
Q

What is an ARP request?

A

Sometimes the IPv4 address of the needed device is not in the ARP table, in which case an ARP request needs to be sent. The ARP request is broadcast out to the entire network, so that all Ethernet NICs on the LAN process the request. Only one device will have an IPv4 address that matches the request, all other devices will ignore the request.

73
Q

What is in the ARP request message?

A

The ARP request message contains a target IPv4 address, and the unknown target MAC address which will be empty.

74
Q

What is in the ARP request header?

A

A destination MAC address, which is a broadcast address requiring all Ethernet NICs on the LAN to accept and process the request.
A source MAC address which is the MAC address of the ARP request’s sender.
A type identifier which informs the receiving NIC that the data portion of the frame needs to be passed to the ARP function. The type identifier for ARP requests is 0x806.

75
Q

Does a router forward broadcasts out other interfaces?

A

No, a router will not forward broadcasts out other interfaces.

76
Q

What is an ARP reply?

A

When the device with the IPv4 address matching the target IPv4 address receives the ARP request, it will send an ARP reply. The reply will be a unicast reply to the device that originally sent the ARP request. Once the device receives the ARP reply it will add the IPv4 address and the corresponding MAC address to it’s ARP table.

77
Q

What is in the ARP reply message?

A

Sender’s IPv4 address – This is the IPv4 address of the sender, the device whose MAC address was requested.
Sender’s MAC address – This is the MAC address of the sender, the MAC address needed by the sender of the ARP request.

78
Q

What is in the ARP reply header?

A

Destination MAC address – This is the MAC address of the sender of the ARP request.
Source MAC address – This is the sender of the ARP reply’s MAC address.
Type - ARP messages have a type field of 0x806. This informs the receiving NIC that the data portion of the frame needs to be passed to the ARP process.

79
Q

What happens if no device responds to an ARP request?

A

The packet is dropped because a frame cannot be created.

80
Q

What are static map entries in an ARP table?

A

They are entries that do not get removed from the ARP table after a certain amount of time. They must be manually removed from the ARP table. This is rarely done.

81
Q

How are entries removed from an ARP table?

A

They either automatically expire, or they can be manually removed. Once removed the process of sending an ARP request and receiving an ARP reply must occur again to enter the map back into the ARP table.

82
Q

How long do entries stay in the ARP table?

A

It varies between device operating systems. Some Windows OSs store entries for 2 minutes.

83
Q

How do you display the ARP table on a Cisco router? On a Windows 7 PC?

A

Router: Use the command “show ip arp”

Windows 7 PC: Use the command “arp -a”

84
Q

What is the downside of an ARP request on a large network?

A

If a large number of devices were all attempting to start accessing network services at the same time, the ARP broadcasts may cause a reduction in performance for a short period of time. However once the initial broadcasts have been sent out and the necessary broadcasts have been learned, impact on the network will be minimized,

85
Q

What is ARP spoofing?

A

Also called ARP poisoning, ARP spoofing is a technique used by an attacker to reply to an ARP request for an IPv4 address belonging to another device, such as the default gateways. The attacker sends an ARP reply with its own MAC address, causing the sender of the ARP request to enter the wrong MAC address value to its ARP table, and forward the packets to the attacker.