Chapter 31. IEEE-802.3 Protocol

The IEEE-802.3 Protocol is based on the Xerox Network Standard (XNS) called Ethernet. The IEEE-802.3 Protocol is commonly called Ethernet but it is just one version. These are the four versions of the Ethernet frame:

NOTE: The Source and Destination must have the same Ethernet Frame type in order to communicate.

CSMA / CD (Carrier Sense Multiple Access / Collision Detect)

Bus arbitration is performed on all versions of Ethernet using the CSMA / CD (Carrier Sense Multiple Access / Collision Detect) protocol. Bus arbitration is another way of discussing how to control who is allowed to talk on the medium (and when). Put simply, it is used to determine who's turn it is to talk.

In CSMA / CD, all stations, on the same segment of cable, listen for the carrier signal. If they hear the carrier, then they know that someone else it talking on the wire. If they don't hear carrier then they know that they can talk. This is called the Carrier Sense portion of CSMA / CD.

All stations share the same segment of cable, and can talk on it similar to a party line. This is the Multiple Access portion of CSMA / CD.

If 2 stations should attempt to talk at the same time, a collision is detected, and both stations back off--for a random amount of time--before they try again. This is the Collision Detect portion of CSMA/CD.

IEEE 802.3 Ethernet Media Types

IEEE 802.3 defines five media types of IEEE 802.3 Ethernet Types shown below:

IEEE 802.3 - 10Base5 (Thick Coax) is used only as backbones to networks. Backbones are lines that connect buildings & network equipment together (such as Bridges, Routers, Brouter, Hubs, Concentrators, Gateways, etc.). 10Base5 is now being replaced by either Thin Coax or fiber optics.

IEEE 802.3a - 10Base2 is commonly used in new installations as a backbone to connect buildings and network equipment together. 10Base2 (Thin Coax) is also used to connect work stations together, but the preferred choice is to use 10BaseT.

IEEE 802.3b - 10Broad36 is rarely used; it combines analog and digital signals together. Broadband means that a mixture of signals can be sent on the same medium.

IEEE 802.3e - StarLAN is a slow 1 Mbps standard that has been replaced by Thin Coax or Twisted Pair.

IEEE 802.3i - 10BaseT is commonly used to connect workstations to network hubs. The network hubs can use 10BaseT (Twisted Pair) to connect to other Hubs.

IEEE 802.3 10Base5

10Base5 Specifications :

Coaxial Cable

Coaxial cable uses double-shielded 0.4 inch diameter RG8 coaxial cable (about the size of a garden hose). The cable is not flexible, and difficult to work with. The cable has a characteristic impedance of 50 ohms.

Connection to the workstation is made with a MAU - Medium Attachment Unit (or Transceiver). The MAU physically and electrically attaches to the coaxial cable by a cable tap. The cable is pierced, and a connection is made (by a screw) to the center conductor.

The MAU is connected to the NIC (Network Interface Card) by the AUI (Attachment Unit Interface) cable. The AUI port on a NIC (and a MAU) is a DB15 connector. Maximum AUI cable length is 50 m.

Cable Termination and Connector

The standard termination is 50 +/-2 ohms. The end connector on the RG-8 cable is an "N" type connector. The cable is externally terminated with a resistor inside an N connector.

Grounding

To minimize noise on the segment, the cable is grounded at the termination--at only one end.

Maximum Nodes on a cable segment

On any single cable segment, the maximum allowed number of nodes or MAUs is 100.

Minimum Distance between nodes

Minimum distance between nodes, or MAUs, is 2.5 m (or 8 feet).

Velocity of propagation

The speed of the signal through the cable is 0.77c. ("c" is equal to the speed of light - 300,000,000 m/sec). The velocity of propagation for 10Base5 specification cable is equal to 0.77 x 300,000,000 m/sec. This is determined by cable capacitance. Maximum coaxial cable segment length is 500 m

The maximum segment length is 500 m--or, a maximum 2.165 uSec propagation delay. Propagation delay is what actually determines the maximum length of the segment.

Propagation delay for a specific cable length in meters is calculated by:

What is the propagation delay for a 500 m length of 10Base5 cable?

Maximum Number of Segments

Maximum of 5 segments (with 4 repeaters) can be along the path between any 2 network nodes: 3 may be coax segments having a maximum delay of 2.165 uSec and 2 may be link segments having a maximum delay of 2.570 uSec.

With no link segments used, three populated coax segments can exist on a path.

The 5-4-3 Rule

The 5-4-3 Rule states that you are allowed five (5) segments, with four (4) repeaters, and three (3) populated segments.

Maximum Transfer Rate

The Maximum Data Transfer Rate for IEEE 802.3 is 10 Mbps (10,000,000 bits per second of data). In fact, data transfer is dependent on how many users are fighting for the bus--and how fast the user's data can get on the bus.

Physical Bus / Logical Bus

IEEE 802.3 is a Physical Bus - the cable is physically laid out as 1 long cable with the network nodes attached to it. It is also treated as a Logical Bus - electronically and logically, it appears as one long cable, with the network nodes attached to it.

IEEE 802.3a 10Base2

Coaxial Cable

Uses RG-58A/U coaxial cable, 0.2 inch in diameter. The cable is flexible and easy to work with. The cable has a characteristic impedance of 50 ohms.

Connection to the workstation is made with either a MAU - Medium Attachment Unit / Transceiver, or directly to the NIC using a BNC TEE.

Most NICs have the MAU built-in for 10Base2. The 3C509 card in the lab have built-in MAUs for Coax (10Base2) and Twisted Pair (10BaseT). They also have a AUI connection for an external MAU, such as used in 10Base5. You can buy MAUs for 10Base2 and 10BaseT (if your NIC does not have them already built-in).

Cable Termination and Connector

The standard termination is 50 +/-2 ohms. The end connector is an "BNC" twist and lock-type connector. The cable is externally terminated with a special terminating BNC connector. BNC stands for Bayonet Navy Connector.

Grounding

To minimize noise on the segment, the cable is floating. The IEEE 802.3a specifications calls for all BNC connectors and TEEs to be insulated. A common problem with 10Base2 is having the barrel of the BNC connector touching a heating duct or computer chassis. The shield should be floating: it is not connected to electrical ground.

Maximum Nodes on a cable segment.

On any 1 cable segment, the maximum allowed number of nodes is 30.

Minimum Distance between Nodes

Minimum distance between nodes is 0.6 m (2 feet).

Velocity of propagation

The speed of the signal through the 10Base2 cable is 0.65c. ("c" is equal to the speed of light - 300,000,000 m/sec). The minimum velocity of propagation for 10Base2 specification cable is equal to 0.65 x 300,000,000 m/sec. This is determined by cable capacitance.

Maximum coaxial cable segment length 185 m.

The maximum segment length is 185 m (600 ft.), or a maximum 0.949 uSec propagation delay. Propagation delay, not distance, is what actually determines the maximum length of the segment. Propagation delay (units are seconds) is calculated by:

What is the propagation delay for a 185 m length of 10Base2 cable?

Maximum Number of Segments

Maximum of 5 segments (with 4 repeaters) can be along the path between any two network nodes: 3 may be coax segments having a maximum delay of 0.949 uSec, and 2 may be link segments having a maximum delay of 0.949 uSec.

With no link segments used, three populated coax segments can exist on a path.

Maximum Transfer Rate

The Maximum Data Transfer Rate for IEEE 802.3a is 10 Mbps (10,000,000 bits per second of data). In actual fact, data transfer is dependent on how many users are fighting for the bus--and how fast the user's data can get on the bus.

Physical Bus/Logical Bus

IEEE 802.3a is a Physical Bus - the cable is physically laid out as one long cable, with the network nodes attached to it.

It is also treated as a Logical Bus - electronically and logically, it appears as one long cable, with the network nodes attached to it.

IEEE 802.3i 10BaseT

Twisted Pair Cable

10BaseT uses unshielded twisted pair (UTP) cable. The cable is flexible and easy to work with. The cable has a characteristic impedance of 100 ohms. There are 2 pairs of twisted wires used with 10BaseT: separate Rx (receive) and Tx (transmit) pairs. The lines are balanced lines to minimize noise and there are a Rx+ & Rx- pair and a Tx+ & Tx- pair.

The nodes are connected to a MPR (multi port repeater), also called a Concentrator, or Hub. The cables are wired as straight-through cables: this means that the Node's Rx & Tx lines connect directly to the Hub's Rx & Tx lines respectively.

Two nodes can be directly connected together (bypassing the Hub) by using a Cross-over (X-over) cable. In a X-over cable, the Tx and Rx lines are crossed so that one node's Tx lines go to the other node's Rx lines--and vice versa.

Cable Termination and Connector

The standard termination is 100 ohms. The end connector is an "RJ45" quick disconnect connector. The cable is internally terminated at the NIC (Network Interface Card) and Hub.

Grounding

To minimize noise on the segment, the cable is a balanced line with Rx- & Rx+ and Tx- & Tx+. There is no shielding: any noise that appears on the Rx+ wire will appear on the Rx- wire. When the 2 signals are combined, the noise cancels because Rx- & Rx+ is 180 degrees out of phase.

Maximum Nodes

For 10BaseT, the maximum allowed number of nodes is 128 (on one segment).

Maximum Distance between Nodes & Hub

The maximum distance between nodes & Hub is 100 m.

Velocity of propagation

The speed of the signal through the cable is 0.59c. ("c" is equal to the speed of light: 300,000,000 m/sec). The minimum velocity of propagation for 10Base5 specification cable is equal to 0.59 x 300,000,000 m/sec., and is determined by cable capacitance.

Maximum cable segment length 100 m

The maximum segment length is 100 m, or a maximum 0.565 uSec propagation delay. Propagation delay, not distance, is what actually determines the maximum length of the segment. Propagation delay (units are seconds) is calculated by the following:

What is the propagation delay for a 100 m length of 10BaseT cable?

Maximum Number of Segments

A maximum of 5 segments (with 4 repeaters) can be along the path that's between any 2 network nodes: 3 may be coax segments, having a maximum delay of 0.565 uSec, and 2 may be link segments, having a maximum delay of 0.565 uSec. The 5-4-3 rule, and its special implications for IEEE 802.3i., will be discussed under Repeaters

Maximum Transfer Rate

The Maximum Data Transfer Rate for IEEE 802.3i is 10 Mbps (i.e. 10,000,000 bits per second of data). In actual fact, though, data transfer is dependent on how many users are fighting for the bus--and how fast the user's data can get on the bus.

Physical Star / Logical Bus

IEEE 802.3a is a Physical Star. The cable is physically laid out as star pattern, with all twisted pair cables (AUIs) coming from the nodes to a central wiring closet (containing the Hub, or Multi-Port Repeater / Concentrator).

It is treated as a Logical Bus: electronically and logically, it appears as 1 long cable, with the network nodes attached to it. A node can be a client, a server, a workstation, or other hub.

MAC - Medium Access Control

The IEEE 802.3 Medium Access Control layer is physically located in the firmware (ROM) of the Network Interface Card. It is the link between the Data Link Layer and the Physical Layer of the OSI model, and logically resides in the lower portion of the Data Link Layer. There is only 1 MAC layer for all of the IEEE 802.3 versions (802.3, 802.3a, 802.3b, 802.3i, etc.).

The IEEE 802.3 Medium Access Control uses CSMA/CD (Carrier Sense Multiple Access/Collision Detect) to determine Bus Arbitration. The MAC layer is concerned with the order of the bits, and converting the Datagram from the Network Layer into Packets/Frames.

Preamble

The Preamble is used to synchronize the receiving station's clock. It consists of 7 bytes (consisting of 10101010 each).

Start Frame Delimiter (SFD)

The Start Frame Delimiter indicates the start of the frame. It consists of 1 byte of 10101011. It is an identical bit pattern to the preamble mentioned above, except for the last bit.

Start Frame Delimiter (SFD)

The Start Frame Delimiter indicates the start of the frame. It consists of 1 byte of 10101011. It is an identical bit pattern to the preamble, except for the last bit.

The Destination Address (DA)

The DA indicates the destination (receiving station) of the frame. It can be 2 or 6 octets long (16 or 48 bits); usually, it is 6 octets (the 2 octet version is used for compatibility with the original Ethernet frame from XNS, and is considered obsolete).

The DA field consists of the following:

I / G stands for Individual/Group. It indicates whether the destination is for an individual or for a multicast broadcast. It is one bit long, as shown below:

0 = Individual1 = Group

A multicast broadcast can be for everyone or for a group. For a multicast broadcast to all stations, the Destination Address = FFFFFFFFFFFFh (h - hexadecimal notation). To multicast to a specific group, unique addresses must be assigned to each station--by the Network Administrator.

U / L stands for Universal/Local. It allows for unique addresses. It is used to indicate whether or not a local naming convention is used, and is administered by the Network Administrator (not recommended - an incredible amount of work). The burnt-in ROM address is also used (and is recommended).

The 46-Bit Address Field consists of 46 bits. This address field indicates the destination NIC card's address, which is burnt into the firmware (ROM) of the card. It can also be the unique name assigned to the card during the card's initialization--by the Network Administrator.

Source Address (SA)

The Source Address indicates the source--or transmitting station--of the frame. It is identical in format to the Destination Address, but always has the I/G bit = 0 (Individual/Group Bit = Individual).

Length (L)

The Length field indicates the Length of the Information Field: it allows for variable-length frames. The minimum Information Field size is 46 octets and the maximum size is 1500 octets. When the Information Field size is less than 46 octets, the Pad field is used. Because the 802.3 MAC Frame has a Length field, there is no End Delimiter. The Length of the field is known and the receiving station counts the number of octets.

Information Field (Data)

The Information Field contains the Data from the next upper layer, the Logical Link Control Layer. It is commonly referred to as the LLC Data. The minimum Information Field size is 46 octets and the maximum size is 1500 octets.

Pad

The Pad is used to add octets--to the Information Field--to bring it up to the minimum size of 46 octets (if the Info Field is less than the minimum).

Frame Check Sequence (FCS)

The Frame Check Sequence is used for error-checking at the bit level. It is based on 32 bit CRC (Cyclic Redundancy Checking), and consists of 4 octets (4 x 8 = 32 bits). The FCS is calculated according to the contents of the DA, SA, L, Data and Pad fields.

Total Length of a MAC Frame

Packet Sniffing

A packet sniffer captures packets from the Ethernet bus. The network interface card (NIC) acts in a mode called "promiscuous mode." Promiscuous mode means that the NIC can look at all traffic on the wire, and not just traffic addressed to itself. Normally, the NIC ignores all traffic (except for packets addressed to itself, multicasts and broadcast packets).

The following captured packet is displayed in raw format. Raw format is hexadecimal numbers that are in rows of 16 digits (see below).

FF  FF  FF  FF  FF  FF  00  20  AF  10  9A  C0  00  25  E0  E003  FF  FF
00  22  00  11  00  00  00  00  FF  FF  FF FF  FFFF  04  52  00  00  00  00  00  20  AF  10
9A  C0  40  0B  0001  00  04  00  00  00  00  00  00  00  00  00

Raw Captured Packet

Raw captured packets do not display the Preamble, Start Frame Delimiter or the Frame Check Sequence fields. These fields are used to inform the receiving station of a new frame, and also for error checking.

The breakdown of the packet (according to the Ethernet MAC frame) is shown below:

The length of the data in the Info field is 0025h, or 37 bytes long. The minimum Info field size is 46 bytes so the data is padded with 9 bytes of 00h.

The Length / Type field value is less than 05DCh (1500 in decimal). This statistic indicates that it is an Ethernet_802.2 frame (IEEE 802.3) that has a Logical Link Control layer (covered later) between the MAC layer and the Network layer.

If the value is 0800h, this indicates an Ethernet_II frame used for TCP/IP.

If the value is 8137, this indicates an Ethernet_802.3 (raw) frame used by pre 3.12 Netware.

The complete listing of the Length/Type field assignments is covered in Appendix C Ethernet Type Field.

Looking at the MAC block diagram, the data from the Info field is shown broken down (up, to be more exact) into the higher levels: Logical Link Control layer, Network layer and Transport layer. Note: A thorough knowledge of each of the layers, and quite a few handy reference books, are required in order to determine exactly what is happening. The remaining layers will be examined as an example only.

Note: Modern packet sniffer will break down the raw packet's fields for you.

LLC Layer

The first 3 bytes of the data--in the Ethernet frame Info field-- is the header of the Logical Link Control layer (LLC IEEE 802.2).

1st byte:E0Destination Service Access Port (DSAP)
2nd byte:E0Source Service Access Port (SSAP)3rd byte:03Control code

E0h indicates that it is a Novell Netware stack talking (source) to a Novell Netware stack (destination). The 03h is the LLC layer's handshaking. The size of the LLC's Data field is 34 bytes. The LLC layer is covered extensively in the next chapter (Chapter 34).

Network Layer

The data of the LLC layer becomes both the header and data of the layer above it (the Network layer). In this case, it is an IPX PDU (Protocol Data Unit). This is indicated by the first 2 bytes being FFFFh (the IPX checksum).

(Hex)1st 2 bytes:FFFFIPX Checksum
(always FFFFh, FCS does error checking)Next 2 bytes:0022IPX PDU length
allowable range 001Eh (30) to 0240h (576)Next byte:00Transport control field - hop count,
allowed 00 to 0Fh (15)Next byte:11Packet Type 11h (17) is Netware Core Protocol (NCP)
Next 4 bytes:00000000Destination network address, all 0s indicate local networkSegment number
in server autoexec.ncf fileNext 6 bytes:FFFFFFFFFFFFDestination host address
(same as dest MAC address)Next 2 bytes:0452Destination socket ,
Service Advertising ProtocolNext 4 bytes:00000000Source network address
(all 0s indicate local network)Next 6 bytes:0020AF109AC0Source host address
(same as soruce MAC address)Next 2 bytes:400BSource socket
(arbitrarily assigned starting at 4000h)Last 4 bytes:Data

The following tables describe the field values for the IPX PDU's packet type and Socket numbers:

 Packet TypeField Value PurposeNLSP00hNetware Link Services ProtocolRIP01hRouting Information
Protocol SAP04hService Advertising ProtocolSPX05hSequenced Packet ExchangeNCP11hNetware Core
ProtocolNetBIOS14hNetBIOS and other propagated packets

IPX Packet Type Field

Netware Socket Numbers and Processes

Socket NumberProcess451hNetware Core Protocol (NCP)452hService Advertising Protocol
(SAP)453hRouting Information Protocol (RIP)455hNovell NetBIOS456hDiagnostics9001Netware
Link Services Protocol (NLSP)9004IPXWAN Protocol

Transport Layer

The Network layer's Data field becomes the Transport layer's PDU. In this case, it is only 4 bytes long.

1st 2 bytes:0001Packet type (Standard Server Request)
Next 2 bytes:0004Service type (file server)

The following tables describe the values of the Service Advertising Protocol's Packet Type and Service Type fields:

Field Value (hex)Packet Type01Standard Server Request02Standard
Server Reply03Nearest Server Request04Nearest Server Reply

SAP Packet Types

Field Value (hex)Service Type0000Unknown0003Print Queue0004File
Server0005Job Server0007Print Server0009Archive Server0024Remote Bridge Server0047
Advertising Print Server8000All values are reserved up to 8000FFFFWildcard

Example Packet Sniffing Summary

This packet is commonly called a Standard Server Request. It is broadcast (Destination FF-FF-FF-FF-FF-FF) on the local network (00-00-00-00) f rom a Novell Netware client. The client is looking for a file server to login in to. The server would respond with a Server Advertising Protocol PDU listing its services.

If this section was helpful, why not donate to further development?

Donate $1.25.

Donate $2.50.

Donate $5.00.