Session 1: Ethernet Flashcards
What is ethernet?
Ethernet is a layer 2 (Data link layer) protocol used for transmitting information in segments known as frames in wires. Ethernet is also known as IEEE 802.3. As Ethernet is used in wired communication, it is an essential protocol for all networks as eventually you will need to transmit using cables.
Why was network sniffing such a simple task on older versions of Ethernet?
The earliest versions of ethernet simply used a single bus (cable) where the transmitters connected themselves using a vampire tap (a device to connect to a bus). When all traffic went over a a single cable it was rather trivial to listen to network traffic.
Modern ethernet configurations no longer use a single bus, but rather a switch and a different network topology, e.g., a star topology with the switch being the central node. These switches are known as intelligent since they only transmit a ethernet frame to the intended participant. Consequently, network sniffing is now significantly harder to achieve.
How are ethernet frames structured.
The layout of ethernet frames depend on the version of ethernet, some of the commonly seen fields are:
The ethernet frame begins with an 8-byte preamble using the pattern 101010.. until ending with a 11. This pattern is essential for indicating the start of a new frame as there is almost constant traffic such networks, and it works since the probability of the given pattern to occur randomly equals 0.5^64.
Following the preamble there is the 6-byte destination and source address following the data section which contains the payload. This can be up to 1500 bytes (depending on the version of ethernet).
FCS or frame checksum is a 4-byte field used for detecting data corruption.
Finally, every frame is interleaved by a 9.6 microsecond gap.
