Chapter 9 Hardware Address & Chapter 9 Hardware Address &

Frame Type IdentificationFrame Type Identification Hardware address of frameAddressing schemesEthernet Frame header format

Hardware addressHardware address

physical address that is unique to each node (station, computer, network equipment)

Each frame transmitted on network contains a source address field and a destination address field

Physical address is the unique address burned into each NIC card

Hardware addressing Hardware addressing schemes schemes

Static Addressing– universally unique physical address already assigned by

hardware manufacturer (most common) Configurable addressing

– physical address on EPROM can be set by user Dynamic addressing

– at boot up, computer generates and broadcasts a potentially unused physical address. Hardware manufacturers need not coordinate in assigning unique range of address

Frame Headers & Frame FormatFrame Headers & Frame Format

Each packet consists of a frame header followed by frame data (fig 9.2)

Format of the headers differ for different network technologies (eg. Ethernet or Token Ring).

Ethernet version 2(DIX) Ethernet version 2(DIX) frame formatframe format

Header (fig 9.3)– Preceded by a 64-bit (8 byte) preamble containing

alternating 1 & 0’s for synchronization– 6 byte destination address field– 6 byte source address field– 2 byte Ethernet frame type (eg. 0800x => IP).

Eg. 0800x IP version 4

8137x IPX809Bx Appletalk806x ARP80D5x IBM SNA

Payload– 46-1500 bytes data– Followed by 4 byte CRC

Unicast FrameUnicast Frame

sender sends a packet destined for a single network node by using the unique hardware address of destination node

network interface card on each machine looks at the destination field of every packet. If the destination address in the frame matches the computer’s physical address, the frame is sent to the operating system of the computer; otherwise the frame is discarded

Broadcast FrameBroadcast Frame

sender sends a packet destined for all network nodes by using a reserved broadcast address such as FF:FF:FF:FF:FF:FF in Ethernet frame

network interface card on each machine looks at the destination field of every packet. If the destination address in the frame is the broadcast address or matches the computer’s physical address, the frame is sent to the operating system of the computer; otherwise the frame is discarded

Network AnalyzerNetwork Analyzer

Sniffer / protocol analyzerdedicated computer used to analyze

network activity by reading every packet and delivering it to the analyzer software.

NIC is put in promiscuous mode Snoop, ethereal, Etherpeek