Bitzenbytes.com

Ethernet Networking

To build your home local area network, you need to know how a network functions.   To get started, you should be familiar with functions at the first three interconnect layers (OSI Model).  For our purposes, that means:

• Internet Protocol (IP from TCP/IP) for network layer
• Ethernet for data-link layer
• Unshielded Twisted Pair (UTP) copper or wireless for physical layer

Thickwire Coaxial Ethernet is interesting to us for a few reasons:

• It's an uncomplicated entire view of a physical network architecture.
• As a piece of Ethernet/LAN history, it still affects how networks are configured today.
• Believe it or not, there is still some of this in use.

A network is an associated group of computers, printers, and other network devices that are connected together for the purpose of communicating, usually with cables and sometimes via other media and other non-cabled media devices (e.g., wireless devices that use radio waves transmitted through the air.)  For our examples, we'll stick mostly to cable systems.  In fact, we're going to stick to mostly copper cable systems though occasionally we'll come in contact with fiber optic cable segments. For this document, we'll be sticking with coaxial cable, but note that the concepts that go with that are universal--without this as a base for your networking knowledge, you may miss the importance of some design concepts. As network transmission speeds increase, fiber optic cable segments will become more common.  Digital data, in the form of radio wave information, travels over the copper network cables, allowing network users to move documents & other data between computers, to print to common printers, to share software, to control programs running on other computers, and to share networked hardware connected to the network.

Further, we're going to be mostly looking at Ethernet (and derivatives) which has become the most popular network architecture for local area networks (LANs.)  Much network communication, that does not employ Ethernet, is used to move information from one Ethernet network to another.  The technology used for LANs is gradually being expanded eliminating some traditional Ethernet LAN segments and depending, more and more, on non-Ethernet networks.

Ethernet specifications define how the network operates at the physical and data-link layers of the OSI (Open Systems Interconnection) model of networking.

  Ethernet:

• sends data, one bit at a time, down serial interface media
• all communications is accomplished using physical (hardware) addresses
• uses half-duplex mode (a node can send or receive but not both simultaneously)
• Carrier Sense Multiple Access with Collision Detection (CSMA/CD)
• Data transmitted in Frames of 64 to 1518 bytes

Network Topology

Having followed the rules and adhered to specifications, the diagrams (that show the logical and physical geography of a network installation) reveal what is called the physical network topology.  Physical network topology identifies the routes or paths between the gateways, networks, and hosts that compose your network, as well as the location of those networks and specific hosts to which you want to limit or restrict access by network users.  It shows the location of all physical components that include server devices, client devices, resource devices, and network communication devices.

Network Topologies

  Note: The Illustration above shows simplified
network topology diagrams
for the purpose of
identifying types of network topology.

Ethernet Topology

Ethernet generally employs a logical bus topology though it may appear, in some cases, to look, physically, like star or tree topology.  As transmission of packets rely more on switches and less on the capability of the transmitting stations (or other network devices) to maintain open, shared media for data transmission, reliance on bus topology decreases.  The logical bus topology, in general, maintains a likeness of the physical topology paradigm originally specified for Ethernet.  Essentially, for what appears to be star or tree topology in a modern network, the bus part is recreated within centrally located network devices; this has, in the past, been referred to as a "collapsed backbone."   The essence of the bus is that, when one node on the bus transmits, all other nodes listen (this is sometimes referred to as "half duplex.")  What allows Ethernet to use a bus topology is its method of controlling communications among nodes attached to the network.  Ethernet is the most widely used LAN network media technology today because it has kept pace with network needs, and it is relatively easy and inexpensive to deploy.

A Simple Thick-wire, Single Cable Segment, Ethernet Backbone

Note: Low-profile Transceivers are depicted.

Cabling

The most popular type of network cabling is unshielded twisted-pair (also known as CAT-5 & used for 10BaseT, 100BaseT and 1000BaseT).  Thin-wire or RG-58 coax (used for 10Base2) is also still employed in many installations though there are few new coax installations being deployed today.  Thick-wire or RG-8 coax (used for 10Base5) is seldom used anymore though there are some installations still in use.  There are many types of coax designated for a variety of uses.  Where thick wire was employed in the past to cover longer distances, fiber-optic cable, at higher bandwidth, is used today.  As for the bus topology, CSMA/CD, "backbone" paradigm, it is a useful model for laying out a network logically, but physically, it seems to barely exist any more.

Common LAN cable specs are ThickNet (RG-8, DIX/AUI connectors, Spinal Tap), ThinNet (RG-58, BNC-T connectors), CAT-3 (voice, 10BaseT, RJ-45 connectors), CAT-4 (Token Ring), CAT-5 (100BaseT, RJ-45).  1000BaseT is not yet in common use, but it seems inevitable that it will be.  CAT-5e is currently the minimum UTP specification for structure premises wiring, and it, along with fiber, is the bulk of the cable used for LAN communications today.  CAT-6 seems to be up-and-coming.  CAT-7 is yet a gleam in somebody's eye.

Network quality can be measured at least three ways described by bandwidth, latency, and network errors.

• Bandwidth is measured as the raw data transfer speed in bytes per second.
• Latency is measured as the elapsed time for a single byte to reach its destination.
• Errors are measured as the number of dropped or corrupted data packets.

Bandwidth, or throughput, describes how much data can be sent over the network, measured in bytes per second during some activity, such as when downloading a large file. Network links are often described by bandwidth, from 75 baud modems to 100 Mbit Ethernet.

Latency is the time it takes, usually measured in milliseconds, for a single byte or packet to travel from one host to the other. The best way to measure this is sending a "ping" packet to a host, who immediately responds with a "pong". Divide the round trip time by two to calculate the average one-way latency. Where bandwidth describes how much data a link supports, latency measures how fast a given packet moves from point A to point B.

Finally, network communications are unreliable. Electrical interference can corrupt packet data, a busy router may drop packets, or a working link may suddenly fail and cut off parts of the network. Packets may also arrive safely, but out of order, by travelling different paths.

Thickwire Coax Cable

Ethernet network topology is, basically, bus topology.  In the first, thick-wire, baseband Ethernet networks, a "half-inch" thick (10.287 mm/0.405 in. diameter RG-8) coaxial cable served as the bus or backbone.   Each end of the cable was terminated with a 50 ohm resister.  One, only, of the terminators had to (should) be grounded to earth.  The maximum length of a single uninterrupted cable segment is 500 meters (1640 feet.) 

All devices attached to the backbone cable with a transceiver.   Vampire tap transceivers, also called a MAU (Media Attachment Unit), served to put signal on, and read signal from, the coax cable.  Up to 100 transceivers can be placed on a Ethernet LAN.  An AUI cable (15 pin parallel transmission) connects the NIC (typically attached to the computer system peripheral bus) to the transceiver.  "Thick-wire" Ethernet was given that name after RG-58 "quarter-inch" (4.953 mm/0.195 in. diameter) coaxial cable, a "thinner" cable, started being used under the 10Base2 Ethernet specification. Thick Ethernet is also referred to as 10Base5.  

Transceivers

Transceivers on a 10Base5 coax cable should be no closer together than 2.5 meters (8.2 feet.)  DEC RG-8 cable conveniently had black stripes painted on their orange cable jacket at 2.5 meter intervals. Transceivers are hung on the coax cable and connect to the transmission media with a vampire tap. Thickwire Ethernet was given that name after RG-58 coaxial cable, a "thinner" cable, started being used. Thickwire Ethernet supports coax segments up to 500 meters in length and is referred to as 10Base5.  Only transceivers without an SQE  ("heartbeat") test were used on thickwire installations.   These transceivers were typically connected to the NIC (Network Interface Card) of a computer with a thick and stiff AUI cable (Attachment Unit Interface Cable - Maximum length of 50 meters/164 feet) that employed 15 pin AUI connectors.  The past tense is used here because few networks employing thick wire technology are being deployed today; the equipment used to implement a thickwire installation, that is on the trailing edge for transmission speed, is bulky, heavy, stiff, difficult to work with, expensive and requires special tools for installation.   Nevertheless, all present day topology can be thought about as logically conforming to the bus topology that can be easily seen in a thick wire installation.

AUI Cable

The standard AUI transceiver cable is stiff and thick and may be up to 50 meters (164 feet) long.  The 50 meters may be a little deceiving.  How long an AUI cable can be depends on who made it.  In general, it seems that the more flexible and easy the cable is to install, the less length before attenuation kicks in.   Not every cable maker will guarantee 50 meters for their AUI cable.  Some "Office grade" AUI cables may only be rated at 2 to 12 meter lengths.   AUI cables have a 15 pin male connector on one end and a 15 pin female connector on the other end.  Two AUI cables can be spliced together to make a longer cable.   When I did this, I used lots of rubber bands and electrical tape to hold the splice together.  The slide catch for AUI cables is less than dependable.  The splice, of course, can introduce conditions that add to attenuation tendencies. An AUI cable provides 12 volt DC to the MAU and that, of course, must come from the workstation NIC.   An AUI cable also provides a transmit data pair, a receive data pair, and a collision presence pair (CI).

AUI Cable Pin-outs
15-pin Female (Transceiver end)	15-pin Male (NIC Interface end)	Signal
1	1	Gnd
2	2	Control In (CI+)  circuit A
3	3	Data Out (Tx+)   circuit A
4	4	Data In-circuit Shield (common drain)
5	5	Data In (Rx+)  circuit A
6	6	Voltage common Gnd
7	7	NC
8	8	Gnd
9	9	Control In (CI-)  circuit B
10	10	Data Out (Tx-)  circuit B
12	12	Data In (Rx-)  circuit B
13	13	Voltage plus (+12 V @ 500ma)
14	14	Gnd
15	15	NC

Repeater

The maximum length of a single cable backbone segment is 500 meters due to signal attenuation (decay.)  It became evident that baseband network transmission would have to go further than 500 meters in some cases, and a network device called a repeater was introduced to put signal on an adjacent segment.  A repeater simply hears the signal on one wire, amplifies the signal, and retransmits the signal on another wire (or on multiple wires in the case of a multi-port repeater.)  A repeater connects two (or more) LAN segments to make a single larger LAN.  By the rules of Ethernet protocol, the number of cable segments that could be successfully connected in this way turned out to be 5 if two of the intermediate legs contained no host nodes.  The rule states that a  maximum of two InterRepeater Links is allowed between devices with the maximum length of cable allowed at 2.5 Km (1.5 miles), and this is the source of the 5-4-3 rule.  The 5-4-3 rule states that a thick-wire Ethernet LAN cannot be larger than 5 cable segments employing 4 repeaters and only three of those segments can be populated with client nodes (populated segments would be segments 1, 3, 5 in the case of 5 sequential cable segments at maximum length.) 

A common thickwire Ethernet configuration will have an unpopulated vertical backbone connecting populated horizontal segments through the use of a repeater at each horizontal segment; this places two repeaters and one InterRepeater link between any two nodes not on the same LAN.  The maximum number of nodes in this collision domain is still 100.  The specification is limited by the amount of time required to pass Ethernet signal between the extreme ends and any latency introduced by the repeater device.  The number of nodes allowed is determined by the statistical likelihood of collisions.  Repeaters are layer one devices when classified according to the OSI model.  Any device between network segments generally introduces some latency in the signal.

A repeater listens for signal on a port and passes all network traffic heard to the next (port) network segment.  It does not inspect the signal for any data. It does not depend on any higher layer protocols. It simply recreates every bit found in a packet that was broadcast on one segment and transmits the fortified signal on another segment.  A repeater saves nothing in any memory and duplicates everything, including collisions.

Multiple network segments on different floors in a building could be connected with a vertical backbone using repeaters.  Remember that the communication distance between the two nodes with the furthest separation is the limiting distance (and configuration) factor.

The thickwire equivalent of an active hub is called a multiplexer (e.g., DECMux II.)   A multiplexer connects to an RG-8 backbone with an AUI cable and it provides a number of AUI ports to which network nodes can be connected.

Bridge

An Ethernet Bridge connects two or more Ethernet network segments. A network segment is an Ethernet cable segment.  Each bridge interface connected to a network is called a port.  A bridge has at least two ports, and may have more.  Like a repeater, a bridge connects two network segments and can connect dissimilar media. A bridge has the advantage, over a repeater, of being able to limit the traffic on each (or any) segment, eliminating bottlenecks.  Unlike a repeater, a bridge saves packets and if a collision occurs, the bridge will discard the packet without retransmitting it. A bridge is used to extend or segment networks.

When a NIC receives a validly formed packet, the NIC checks to see if the destination (MAC) Address, in the packet header, is an address that it has been configured to recognize and accept. Typically, this is only the embedded MAC Address for the NIC, itself.)  If the destination (MAC) Address is one that the NIC has been configured to recognize (matches its own), then the packet is accepted and passed up to the next higher layer in the protocol stack.

Unlike most NICs, a bridge has no address on the network, yet it listens to the network in promiscuous mode.  It reads and accepts all packets.   The bridge looks up the destination (MAC) Address found in the packet to see if that address is in its internal address table.  From the bridge address table, the bridge can discover which bridge port has the cable segment to which the destination NIC is attached. The bridge forwards the packet onto, only, the necessary port.  The bridge operates at OSI layer 2 (Datalink Layer), and does not process the data in the packet.

In the case of a broadcast or multicast message, the bridge forwards the packet onto every port except the port that the packet came in on. Promiscuous listening is the key to the bridge's transparent operation. Because the bridge effectively "hears" all packets that are transmitted, it can decide whether forwarding is necessary without any special behavior from the individual stations. A bridge is a repeater that makes a decision whether, or not, to recreate received packets and transmit them to the "next" segment; repeaters make no such decisions. 

A translating bridge may be used to translate between two different physical layer protocols (e.g., Ethernet to Token Ring, FDDI to 10BaseT, or 100BaseT to 802.11.)  Unlike a Gateway, a bridge does not translate network level protocols.   A bridge, unlike a router, is protocol independent; it will handle NetBEUI traffic, IPX/SPX traffic, and TCP/IP traffic as if they are all the same; routers are usually network protocol specific.

A bridge is able to connect LAN segments to create a larger LAN.   A bridge is able to filter traffic passing between the two network segments, creating two separate collision domains, and increasing the available bandwidth for each segment.  A bridge can lower traffic on network segments for protocols that are not routable.  A bridge may enforce security policies (can disallow transmission of packets) separating different work groups located on each of the network segments.

When nodes in a network are unaware that a bridge exists, the bridge is called a transparent bridge; for packet transmission in an Ethernet network, this is always the case, the bridge has no physical network address, and the term, transparent, is seldom used. On the other hand, source-routing bridges are used in Token Ring networks and they depend on the sending node to include path information in the packet.  The sending node uses explorer packets to discover the best path to the destination node.  The discovered best path is included in packets for an intended destination.  The source-routing bridge reads the path and stores the path for future packets being sent to that destination.

Recapping to this point, bridges make transmission decisions based on MAC address.  A bridge does this by reading a table that indicates what hosts are on a particular segment attached to the bridge.  It then inspects the destination MAC address in each packet and if the destination host is on a different segment, the bits are retransmitted on that segment only.  If the destination host is on the same segment, nothing is retransmitted.  This reduces the amount of traffic that must be carried on some segments, allowing other hosts, on those segments, to communicate.  So a bridge, like a repeater, also repeats signal, but adds a bit of intelligence to the brew.  Long after they were in practical and common use (e.g., DEC LAN Bridge), bridges were first specified by the IEEE in IEEE 802.1D (1990) and later by the ISO (in 1993).

Let's say that nodes 1,2, and 3 are on port A for the bridge, and nodes 4, 5, and 6 are on port B.   When a packet from node 1 arrives at port A, the destination address is examined by the bridge.  If the destination is one of nodes 4, 5, or 6, the bridge retransmits the packet at port B.  On the other hand, if the destination address was 2 or 3, the bridge does not retransmit the packet.  In this way, the traffic on the wire segment at port B has been reduced, lowering the likelihood of a packet collision for traffic on that segment.  The concept of what a bridge does will be important, later, when we examine the difference between a hub and a switch. 

When the bridge first goes online, it initially forwards all packets that arrive to all segments because it has no entries in its internal address table.  As the bridge receives packets, it learns the address of the sending node and stores that in its internal address table noting the segment on which the address is located.  Depending on the size of the network, the capability of the bridge, and the configuration of the bridge, after some time interval (aging time) of no traffic from a particular node, the bridge may delete the node entry from the source address table.

In a multiple bridge environment, a bridge will learn the bridge topology of the network using bridge protocol data that is transmitted to the network by every bridge present.  The bridges then apply a Spanning Tree Algorithm to select a root bridge and to determine the primary data paths within potential data loop configurations.

Router

Routers Operate at OSI Layer 3 employing Network Addresses to decide where to broadcast a packet.  A router separates networks whereas neither repeaters nor bridges separate networks.  Repeaters and bridges regulate signals transmitted within a single network.  Routers transmit signals between separated networks.  A router receives and forwards messages. For the TCP/IP network protocol, the network address is an IP address.  Typically, both client and server nodes on the network segment know the IP address of the router.  Messages bound for any node that is not on the local network segment are sent to the router.

Gateway (protocol translation)

Many routing protocols refer to routers as gateways.  So the term, gateway, often gets applied to routers.  A router is an OSI layer 3 device.  Protocol Translation Gateways are usually defined as OSI layer 7 internetworking devices.  For example, a system that sits between a DECNet network and an SNA network, and that moves network traffic between the two network architectures is a DECNet/SNA Gateway.

NICs

A network host (a networked computer) is connected to the network cabling with a network interface card (also called a "NIC", or network adapter).  Most NICs are installed, in the computer case, in a slot on the expansion bus, usually either the ISA bus or the PCI bus.   Generally, ISA  (16 bit) NICs are only used with older 286, 386, or 486 computers.  NICs can interface with Ethernet media, Token-ring media, ATM media, fiber media, and others (as long as the NIC is designed and built for that media.).  The most common and most economical of these media types is Ethernet.  Ethernet specifications support several categories of media.  Older ISA Ethernet NICs are typically limited to 10 Mbps, and are usually more expensive than NICs of a newer design.  Pentium class (and up) PC's generally use a PCI (32 bit) NIC that supports 100 Mbps operation.  Most PC's sold today come with a NIC; quite often the NIC is integrated on the motherboard and requires no expansion bus slot. The Industry clearly expects that PC's will be networked wherever they are.

 The media interface for Ethernet NICs can vary.  A NIC may have more than one media interface, or it may only have a single type of media interface. Some NICs will interface only with AUI, or only with 10base2 thin-wire, or only with 10BaseT RJ-45, or only with 100BaseT RJ-45.  The NIC interface must match the media being used.  The NICs illustrated here are combo "cards"; they interface with more than one type of media.  Older "combo" cards would interface to AUI cable or RG-58.  Illustrated here are two newer "combo" cards.  One will interface to either 10BaseT or 10Base2 media.  The other will interface to 10BaseT, 10Base2, or 10Base5 media (AUI.).  As network media, more and more, excludes any coax segments, combo cards are seen and installed much less often.  They were much more prevalent during an era when LANs were making the transition from coax to twisted pair.   They are, typically, much more expensive than cards that incorporate only an RJ-45 connection.  In fact, the price of a NIC has fallen as dramatically as that of a computer. 

Newer PC NICs have only an RJ-45 jack to accommodate CAT-5 cable and it is generally expected that they will be plugged into the PCI bus.   Most will autosense to determine if the protocol being transmitted is 10BaseT or 100BaseT.  These NICs will self configure to conform to the highest appropriate speed available.  They may also autosense half or full duplex signaling.  Since the advent of plug and play, much of the configuration chores for setting up a NIC have disappeared.  At one time, jumpers were used to set IRQ, ports, and memory range required for operation.  If a PC lacks expansion slots (laptops and notebooks), PCMCIA NIC adapters may be employed if the unit supports a PCMCIA slot.  There are also USB and parallel printer port adapters available.

Ethernet

Ethernet specifications define how the network operates at the physical and data-link layers of the OSI (Open Systems Interconnection) model of networking.  Ethernet:

• sends data, one bit at a time, down serial interface media
• uses half-duplex mode (a node can send or receive but not both simultaneously)
• employs Carrier Sense Multiple Access with Collision Detection (CSMA/CD)
• Transmits data in Frames of 64 to 1518 bytes

CSMA/CD

Carrier Sense, Multiple Access with Collision Detection (CSMA/CD), a protocol for broadcasting, listening, and detecting collisions, is used on thick wire Ethernet installations.  Newer forms of Ethernet do not use CSMA/CD, but may use, er, (sic) full duplex Ethernet protocol.

(It may help if you have already read about CSMA/CD in round 1.)  A 10Base5 Ethernet interface broadcasts at 10 Mhz encoding 1 bit per cycle.  This makes the bit time be 100 nanoseconds per bit.   The signal for one bit travels about 100 feet before the second bit is transmitted on the wire.  For two nodes on the wire that are 200 meters (about 650 feet) apart, the transmitting node will be in the middle of sending the seventh bit when the first bit is arriving at the destination node.  Because of this delay, both workstations could have listened to the wire, found it quiet, and have decided, simultaneously, to begin transmitting.  It would take 7 bit times before a collision between the two signals would occur, and that's the reason why collision detection is required.

As we know, a thick wire  Ethernet network can be 1.5 miles long with the use of repeaters.  Potentially, the sending and receiving nodes could be approximately 1.5 miles apart (theoretically, with no latency, approximately 10 bytes of data can be on this wire before the destination node starts receiving.) If the first node starts transmitting and the signal is broadcast down this network wire (through latency producing repeaters), there will be some amount of elapsed time before the beginning of the transmission reaches the destination computer.  Unfortunately, at 1 bit time before that signal reaches the destination node, the destination node makes the decision to transmit.  A collision occurs.  Immediately, the destination node sees the collision and stops transmitting.  However, the collision signal is going to need time to travel all the way back to the sending node.  So the maximum time needed for the sending station to detect a collision is twice the time that it takes for the signal to travel between sending and receiving nodes in a maximum length network segment.  Essentially, the signal transmission must make a "round trip" for a collision to be heard.   Under Ethernet specifications, the round trip time is limited to 50 millionths of a second.

In 50 microseconds, 500 bits can be transmitted and dividing by 8, we discover that this is 62.5 bytes or close enough to 64 bytes for us to accept that 64 bytes is the minimum size packet that can be transmitted so that collision detection can work.  The limit on physical length and the rules for the number of repeaters allowed are based on round trip time.  Extending this length requires the use of a router or bridge.

Normal collisions are the kind that the network was designed to handle.  No collisions would be nice because otherwise network resources are used to handle collisions rather than to send data.  Most network admins figure that about 40% utilization is pretty good.  As that figure approaches 80%, the number of collisions will increase until network traffic collapses because too many devices are in constant contention for the wire.  As the number of collisions rises, the network admin should be considering segmenting the network with bridges or switches.  Obviously, the mere introduction of a bridge may not be enough to alleviate the problem.  If all traffic must pass across the bridge, the bridge will only serve to acerbate the problem.

Paying close attention to the specifications is important.  The spec says that a 64 byte packet must completely fill the medium.  The packet is 64 bytes minimum so that the sending device knows that no collisions have occurred during transmission.   If the medium is less than filled with a 64 byte packet then it becomes possible to have a late collision.  A late collision is a collision detected by the sending device after the last bit of the 64 bytes has left the sending station.  This can occur when turn-around time (round-trip delay) is longer than expected.  This means that the failure of the packet will not be discovered at physical layer and it will be up to protocols higher in the stack to find the transmission problem and to request retransmission of the packet.  This is an extremely slow method of handling a lost packet when compared to the event being handled at the physical layer.  Such problems can be caused by faulty NICs, cables that are too long, and network devices with high latency.

Ethernet Frames

A frame is a collection of bits sent from one computer to another.  A frame is divided into a number of fields used for addresses of source and destination computers, error checking and other reasons as well as a variable size data field that carries from 46 to 1,500 bytes of data.  An Ethernet frame contains a header, a data section, and a trailer (footer).  An Ethernet frame (packet) is defined as containing a 6 byte destination address, a 6 byte source address, a 2 byte type field, 46 to 1500 bytes of data, and a 4 byte CRC field.  The maximum size packet is therefore, 1518 bytes. Uh, sorta; 1518 will do for now. The 4 byte checksum is used to check the integrity of the bits in the frame once the frame has arrived at its destination.

The preamble is an alternating sequence of zeros and ones transmitted to allow the receiver to synchronize to the incoming signal.  The design spec indicates that a NIC should be able to sync in 11 bit times, but some slack is allowed.  The synchronization bits and the start delimiter are discarded.  The two 1 bits at the end of the start delimiter signals the NIC to start saving bits in the NIC's memory buffer.

The first two fields in the frame carry 48-bit addresses, called the destination and source addresses. The IEEE controls the assignment of these addresses by administering a portion of the address field. The IEEE does this by providing 24-bit identifiers called " Organizationally Unique Identifiers" (OUIs).  This 24-bit identifier is assigned to each organization that applies to the IEEE to build Ethernet interfaces. The manufacturer, in turn, creates 48-bit addresses using the assigned OUI as the first 24 bits of the address. This 48-bit address is also known as the physical address, hardware address, or MAC address.

A unique 48-bit address is commonly pre-assigned to each Ethernet interface when it is manufactured. Pre-assigned addresses obviate the need for administering the hardware address.  It is what it is.  All Ethernet interfaces on the shared signal channel look at  the destination address included in the frame header.  If the adapter discovers that the packet is not for itself, it stops saving data to its memory buffer immediately after reading the destination address.

The last 4 bytes that the network adapter receives are the Frame Check Sequence or CRC (Cyclical Redundancy Check number).  This value is checked against a check sum generated by the adapter, using a complex polynomial, as it received the data.

...and from there, we have to consider frame type. <sigh>  See that 2 byte "length" field up there?  Well, pay attention.

The easy one: Ethernet I has disappeared. 

Remember, that Bob Metcalfe worked for Xerox.  At the dawn of Ethernet, various participating companies came up with their own network protocols.  I had a couple of Xerox Star workstations running XNS, some Vaxen running DECNet, and a Novell server running IPX for some PC's.  It was not a fun world when everybody ran their own protocol.  If you wanted these various networks to cooperate, the only solution was a translating gateway, and with the exception of a few combinations, such gateways did not exist as turn-key solutions. 

Xerox, being the originating organization for Ethernet, assigned two byte codes to the various proprietary protocols that each company cooked up.  There's a very long list of them, and some companies weren't content to have one protocol type.  DEC for instance had LAT, Lan Bridge Management Protocol, LAVC, DECNet Phase IV, and others.

The DIX or Ethernet II frame type used the 2 byte "length" field as a protocol type field, and the frame specifications made no provision for including a length of data field.  Remember that a minimum length data field must be transmitted, and if there is not enough data then the field must be padded with zeros.  This frame type required that the encapsulated protocols maintain an internal length field to determine where the data stopped and where the padding began.  They did.

This requirement to maintain length information applies uniquely to Ethernet LAN packets.  While heretofore, protocols carried in an Ethernet frame were expected to contribute a length field, the IEEE did not want their protocol to depend on a condition that was, more or less, unspecified.  So, the IEEE 802.3 frame standard replaced the 2 byte type field with a 2 byte length field.  This created no conflict with existing DIX networks.  When the IEEE 802 committee delivered their Ethernet specification, they had determined that Xerox had not handed out any significant protocol types that had a decimal value of less than 1500.  Any 2 byte "length" field with a value of less than 1500 was an 802.3 frame and any 2 byte "length" field with a value of more than 1500 (05DCh) was a DIX frame.

Novell's proprietary 802.3 (Raw) format was developed from a preliminary release of the 802.3 specification.  After Novell had already released it's version of the protocol, the IEEE added the LLC header making Novell compatible with, ah, Novell.  In Novell frames, the user data begins with an IPX header.  The first two bytes of the IPX header are a checksum, but by convention, the checksum is always turned off which is indicated with a 2 bytes sequence that is all 1's (FFFFh).  This two byte value of FFFFh is what distinguishes a Novell 802.3 (RAW) packet.

Eventually, the IEEE delivered the 802.3 frame format which included a LLC (logical link control) header that is defined by the 802.2 specification which led Novell to call it the 802.2 frame format. The first 14 bytes remain the Data Link Header containing the destination address, the source address, and the length field. The Data Link Header is followed by the Logical Link Control Header containing 3 fields of 1 byte each: DSAP, SSAP, and Control. 

The DSAP (Destination Service Access Point) is a pointer to a memory buffer in the receiving station.  This tells the receiving adapter where to put this information, required where multiple protocol stacks are employed.  The SSAP (Source Service Access Point) is a pointer to a memory buffer in the sending station which specifies the source of the sending process.  The Control byte specifies what type of LLC frame has been sent.  These 3 bytes get deducted from the data field values and the requirements for the data field are now a 43 byte minimum and a 1497 byte maximum.

To this, the IEEE eventually added a 5 byte SNAP (SubNetwork Access Protocol) field to be used by upper layer protocols to distinguish among different protocol packets, creating 802.3 SNAP.

Lets see if we can straighten this out.

When you get down to the nitty-gritty, your network drivers support one or more of these frame types.  If you want two nodes to talk, they both have to support a common frame type.

Windows 2000 attempts to autodetect the frame type when using NWLink (MS version of IPX/SPX).  The order of detection is 802.2, 802.3, II, and then SNAP.

Signaling

Ethernet signal on coax uses Manchester encoding.

Non-return to zero (NRZ) encoding is used for both synchronous and asynchronous transmission in some systems.  For NRZ, a zero is a low line value and a one is a high line value.  The problem with NRZ is that, potentially, a long string of either zeros or ones might be transmitted where there would occur no signal change across a very long number of bit times.  Either data condition would result in no bit transitions (from low value to high value) during a very long, consecutive number of bit times.  It's possible that signal decay or latency could result in loss of synchronization between the sending and the receiving stations.  This lack of transitions prevents the receiver DPLL from regenerating clock resulting in an inability to reliably detect bit boundaries in the signal. This is why Ethernet uses Manchester encoding.

Manchester encoding always contains a bit transition at the center of each bit time.   This can be either a zero to one transition or a one to zero transition.  In this case, a picture is worth a thousand words.

A logical one is defined as a zero-to-one transition in the signal.  A logical zero is defined as a one-to-zero transition in the signal.  These transitions are observed at the center of bit time.  We don't really care what the signal does outside of the center bit time window.  For Manchester encoding, a bit transition occurs for every bit time and the receiver DPLL circuit can keep a stable clock.

Problem Solving

Defects in coax cable typically show up as reflected signal. Very bad kinks, breaks and separations are found with a device called a time-domain reflectometer (TDR).   Essentially, the device sends out voltage like a sonar ping. When it reaches what it sees as the end of the cable, if there is no terminating resistor, the signal bounces back.  Given a type of cable, the TDR measures the amount of RTD (round-trip delay) and computes a distance to the point of reflection.  Get out your tape measure.

More about Ethernet in Round 3.