Ethernet Frames (7.1)
Ethernet operates in the data link layer and the physical layer. It is a family of networking technologies that are defined in the IEEE 802.2 and 802.3 standards.
Ethernet Encapsulation (7.1.1)
This chapter starts with a discussion of Ethernet technology, including an explanation of MAC sublayer and the Ethernet frame fields.
Two LAN technologies are used today: Ethernet and wireless LANs (WLANs). Ethernet uses wired communications, including twisted-pair, fiber-optic links, and coaxial cables.
Ethernet operates in the data link layer and the physical layer. It is a family of networking technologies defined in the IEEE 802.2 and 802.3 standards. Ethernet supports the following data bandwidths:
10 Mbps
100 Mbps
1000 Mbps (1 Gbps)
10,000 Mbps (10 Gbps)
40,000 Mbps (40 Gbps)
100,000 Mbps (100 Gbps)
As shown in Figure 7-1, Ethernet standards define both Layer 2 protocols and Layer 1 technologies.
)
Figure 7-1 Ethernet in the OSI Model
Data Link Sublayers (7.1.2)
IEEE 802 LAN/MAN protocols, including Ethernet, use the two sublayers of the data link layer to operate: the Logical Link Control (LLC) and the Media Access Control (MAC) layers (see Figure 7-2).
)
Figure 7-2 IEEE Ethernet Standards in the OSI Model
Recall that the LLC and MAC sublayers have the following roles in the data link layer:
LLC sublayer: This IEEE 802.2 sublayer communicates between the networking software at the upper layers and the device hardware at the lower layers. It places information in the frame to identify which network layer protocol is being used for the frame. This information allows multiple Layer 3 protocols, such as IPv4 and IPv6, to use the same network interface and media.
MAC sublayer: This sublayer (specified in IEEE 802.3, 802.11, and 802.15), which is implemented in hardware, is responsible for data encapsulation and media access control. It provides data link layer addressing and is integrated with various physical layer technologies.
MAC Sublayer (7.1.3)
The MAC sublayer is responsible for data encapsulation and accessing the media.
Data Encapsulation
IEEE 802.3 data encapsulation includes the following:
Ethernet frame: This is the internal structure of the Ethernet frame.
Ethernet addressing: An Ethernet frame includes both source and destination MAC addresses to deliver the Ethernet frame from Ethernet NIC to Ethernet NIC on the same LAN.
Ethernet error detection: The Ethernet frame includes a frame check sequence (FCS) trailer used for error detection.
Accessing the Media
As shown in Figure 7-3, the IEEE 802.3 MAC sublayer includes the specifications for different Ethernet communications standards over various types of media, including copper and fiber.
)
Figure 7-3 Details of the MAC Sublayer
Recall that legacy Ethernet using a bus topology or hubs is a shared, half-duplex medium. Ethernet over a half-duplex medium uses a contention-based access method, Carrier Sense Multiple Access/Collision Detect (CSMA/CD) to ensure that only one device is transmitting at a time. CSMA/CD allows multiple devices to share the same half-duplex medium and detects a collision when more than one device attempts to transmit simultaneously. It also provides a back-off algorithm for retransmission.
Ethernet LANs today use switches that operate in full-duplex. Full-duplex communications with Ethernet switches do not require access control through CSMA/CD.
Ethernet Frame Fields (7.1.4)
The minimum Ethernet frame size is 64 bytes, and the expected maximum is 1518 bytes. The frame size might be larger than that if additional requirements are included, such as VLAN tagging. (VLAN tagging is beyond the scope of this book.) The frame includes all bytes from the destination MAC address field through the FCS field. The Preamble field is not included when describing the size of a frame.
Any frame less than 64 bytes in length is considered a collision fragment or runt frame and is automatically discarded by receiving stations. Frames with more than 1500 bytes of data are considered jumbo frames or baby giant frames.
If the size of a transmitted frame is less than the minimum or greater than the maximum, the receiving device drops the frame. Dropped frames are likely to result from collisions or other unwanted signals. They are considered invalid. Jumbo frames are supported by most Fast Ethernet and Gigabit Ethernet switches and NICs.
Figure 7-4 shows the fields in the Ethernet frame.
)
Figure 7-4 Ethernet Frame Structure and Field Size
Table 7-1 provides more information about the function of each field.
Table 7-1 Ethernet Frame Fields Detail
Field |
Description |
Preamble and Start Frame Delimiter fields |
The preamble (7 bytes) and start frame delimiter (SFD), also called the start of frame (1 byte), fields are used for synchronization between the sending and receiving devices. These first 8 bytes of the frame are used to get the attention of the receiving nodes. Essentially, the first few bytes tell the receivers to get ready to receive a new frame. |
Destination MAC Address field |
This 6-byte field is the identifier for the intended recipient. Recall that Layer 2 uses this address to assist devices in determining if a frame is addressed to them. The address in a frame is compared to the MAC address in a device. If there is a match, the device accepts the frame. It can be a unicast, multicast, or broadcast address. |
Source MAC Address field |
This 6-byte field identifies the originating NIC or interface of the frame. |
Type/Length field |
This 2-byte field identifies the upper-layer protocol encapsulated in the Ethernet frame. Common values are, in hexadecimal, 0x800 for IPv4, 0x86DD for IPv6, and 0x806 for ARP. Note: You may also see this field referred to as EtherType, Type, or Length. |
Data field |
This field (which can range from 46 to 1500 bytes) contains the encapsulated data from a higher layer, which is a generic Layer 3 PDU or, more commonly, an IPv4 packet. All frames must be at least 64 bytes long. If a small packet is encapsulated, additional bits called a pad are used to increase the size of the frame to this minimum size. |
Frame Check Sequence field |
The frame check sequence (FCS) field (4 bytes) is used to detect errors in a frame. It uses a cyclic redundancy check (CRC). The sending device includes the results of a CRC in the FCS field of the frame. The receiving device receives the frame and generates a CRC to look for errors. If the calculations match, no error occurred. Calculations that do not match indicate that the data has changed; in such a case, the frame is dropped. A change in the data could be the result of a disruption of the electrical signals that represent the bits. |
CHECK YOUR UNDERSTANDING—ETHERNET SWITCHING (7.1.5)
Refer to the online course to complete this activity.
LAB—USE WIRESHARK TO EXAMINE ETHERNET FRAMES (7.1.6)
In this lab, you will complete the following objectives:
Part 1: Examine the Header Fields in an Ethernet II Frame
Part 2: Use Wireshark to Capture and Analyze Ethernet Frames