CSIT 220 (Blum) 1

Hardware Addressing and Frame Type Identification

Some of Ch. 8, Ch. 9 and some of Ch. 10 in Computer Networks and Internets, Comer

CSIT 220 (Blum) 2

Wireless Protocol: CSMA/CA

• Recall that part of the Ethernet protocol was CSMA/CD (Carrier Sense, Multiple Access with Collision Detection). In wireless, this is adapted to CSMA/CA (Carrier Sense, Multiple Access with Collision Avoidance).

• Unlike wired Ethernet in which every computer can communicate with every other computer over the bus or hub, in a wireless LAN two computers may be too far apart to transmit data directly from one to the other.

CSIT 220 (Blum) 3

Collision Detection versus Collision Avoidance

• Suppose you had three computers: 1, 2 and 3. And Computers 1 and 3 are both sending information to Computer 2.

• In a wired LAN, each computer is capable of detecting a collision.

CSIT 220 (Blum) 4

Collision Detection versus Collision Avoidance

• In a wireless LAN, Computer 1 may be out of range for Computer 3 and vice versa. Only Computer 2 would know about a collision.

• But whereas Computers 1 and 3 are in a position to correct the situation (retransmit), Computer 2 is not in a position to do anything.

CSIT 220 (Blum) 5

Collision Avoidance

• So before transmitting a large packet, Computer 1 issues a small control packet indicating it will transmit a larger packet.

• The Computer 2 issues a reply packet which is read by all computers in its vicinity (including Computer 3) that it expects to receive a message from Computer 1. Computer 3 holds off transmitting its signal.

• This is Collision Avoidance.

• It is still possible that the control packets collide, but this is less likely (because control packets are small) and easier to deal with.

CSIT 220 (Blum) 6

FDDI (Chapter 8 topic)

• Fiber Distributed Data Interface: a data-transmission standard on LANs connected by fiber optic cable

• While officially a LAN (local area network) technology, FDDI LANs can be fairly wide spread (MAN): up to 100 km (62 miles).

• Can support thousands of users. • The protocol is a variation of the token ring

protocol.

CSIT 220 (Blum) 7

FDDI (Cont.)

• Uses two rings (one for backup). – Recall a ring-organized network goes down if

one cable is broken.

• The primary ring operates at a capacity of 100 Mbps. – It is possible to use the secondary ring to

double the capacity instead of serving as backup.

CSIT 220 (Blum) 8

FDDI (Cont.)

• FDDI standard was set up the American National Standards Committee X3-T9 and conforms to the Open Systems Interconnection (OSI) layering model. – (More on the OSI model later in the semester.)

• It can be used to connect two or more LANs that use different protocols.

• An extension FDDI-II adds a circuit-switching capability.

CSIT 220 (Blum) 9

Modem vs. NIC

• Often a home user will temporarily join a network (probably a WAN) by means of a modem (internal or external) and a phone line (via ISP, Internet Service Provider).

• Those belonging to a LAN connect to the network on a more permanent basis and usually do so by means of a NIC card.

CSIT 220 (Blum) 10

NIC

• A expansion card is a circuit board, hardware that extends the capabilities of the central parts of a computer which are housed on the motherboard.

• A network interface card (NIC) allows a computer to connect to a network. – On some computers, the network circuitry is on the

motherboard.

• The NIC card must be compatible with the network’s organization (Ethernet, token ring, etc.).

CSIT 220 (Blum) 11

Categorizing NIC’s

• By protocol– Ethernet, Fast Ethernet, FDDI, etc.

• By expansion slot type– ISA, EISA, PCI, MCA, etc.

• By manufacturer– 3Com, Intel, SMC, Asante, Jaycor

CSIT 220 (Blum) 12

Freeing up the CPU• The NIC processes as much incoming and

outgoing information as possible without troubling the CPU

CSIT 220 (Blum) 13

NIC

• The Network Interface Card (NIC) is the expansion (adapter) card responsible for a computer’s interaction with a network (LAN).

• The card is placed in an expansion slot, a socket designed for circuit boards which extend the hardware on the motherboard.

CSIT 220 (Blum) 14

CSIT 220 (Blum) 15

Physical address

• Recall that a manufacturer puts a unique number on an Ethernet card, and it is used as the computer’s physical (hardware, MAC) address with the network.– Vendor identified by upper portion of address.

• You can find your card’s MAC address by running the ipconfig command with the /all option.

CSIT 220 (Blum) 16

ipconfig /all

CSIT 220 (Blum) 17

Slots: PCI and (E)ISA• The names PCI and EISA actually refer to types of

buses, a PCI card goes into a PCI slot that connects to a PCI bus.

• (Extended) Industry Standard Architecture, designed for PCs using an Intel 80386, 80486, or Pentium microprocessor. EISA buses are 32-bit wide and can operate at speeds up to 33 MHz (but 8 MHz is standard).

• Peripheral Component Interconnect: 64-bit implemented as 32-bit bus operating at 33, 66, 100, and proposed 133 MHz.

CSIT 220 (Blum) 18

Speeds

• If the typical PC’s CPU had to continually monitor all of the network traffic, it could not keep up.

• A sniffer in full promiscuous mode could overwhelm a CPU.

CSIT 220 (Blum) 19

Bringing in the data

• The NIC monitors the network traffic and only passes onto the processor information that – Was intended for it (i.e. was unicast and

matches its address)– Was intended for everybody (i.e. was

broadcast)– Was intended for a group to which it belongs

(i.e. was multicast)

CSIT 220 (Blum) 20

Requesting an interrupt

• The data is not passed directly to the processor, rather it is placed in a buffer/memory and the NIC makes an interrupt request.

• The processor only allows itself to be interrupted at certain times.

• All devices (NIC included) interrupt at the same point, the processor must then trace back to find out which device requested the interrupt.

CSIT 220 (Blum) 21

IRQ

• Devices that interrupt the processor are assigned an IRQ (Interrupt Request Line).

• Typically a device has a set IRQ or finds an available IRQ, occasionally two devices want the same IRQ and a conflict arises.

• To find out the IRQ for your network adapter card in Windows 2000, go to Start/Settings/Control Panel.

CSIT 220 (Blum) 22

Double Click on System

CSIT 220 (Blum) 23

Click on Hardware

CSIT 220 (Blum) 24

Click on Device Manager

CSIT 220 (Blum) 25

Click on the + next to Network Adapters

CSIT 220 (Blum) 26

Double Click on the card (or one of the cards)

CSIT 220 (Blum) 27

Click on Resources

CSIT 220 (Blum) 28

Can examine IRQ being used

Using IRQ 9

CSIT 220 (Blum) 29

DMA

• Sometimes, the NIC can place information (from packets) directly into the computer’s main memory without going through the processor.

• In such a case, the NIC is said to have Direct Memory Access (DMA).

• This direct route from device to memory is known as the DMA channel.

• There can arise conflicts over which device is using the DMA channel.

CSIT 220 (Blum) 30

Every NIC is unique

• Every Ethernet Network Interface Card is given a unique address consisting of six bytes (48 bits) – How many such addresses are there?

• It is known as – The hardware address– The physical address– The MAC (Media Access Control) address

CSIT 220 (Blum) 31

MAC Address

• On an Ethernet LAN, information packets travel on the bus, and each NIC compares the bits in the destination address field with its MAC address.

• If they don’t match, it ignores without troubling the CPU. – Sniffers are promiscuous

• If they match, it will make a copy of the packet and pass it on to a higher layer for further processing.

CSIT 220 (Blum) 32

Layers

• Communication between applications on different computers is thought of as occurring in layers.

• The lowest layer is the physical layer consisting of the actual materials and hardware: the cards, the wire, the signals.

• The next higher layer is known as the data linklayer, which converts the signal into data or vice versa (which includes timing (synchronization), error checking, and so on).

CSIT 220 (Blum) 33

CSIT 220 (Blum) 34

Sublayers

• The data link layer is divided into two sublayers: – The MAC (Media Access Control) sublayer:

takes the signal from or puts the signal onto the transmission line (“touches” physical layer)

– The LLC (Logical Link Control) sublayer: starts to interpret the signal as data, includes timing (synchronization) and error checking.

CSIT 220 (Blum) 35

Higher level

• At a higher level (layer), a computer on a TCP/IP network is identified by an IP address, so there must be a correspondence between IP addresses (software) and MAC addresses (hardware)

• The correspondence is not permanent allowing one to change one’s hardware (and thus hardware or MAC address) without changing one’s IP address (software).

• This independence of layers is the reason for layering.

CSIT 220 (Blum) 36

Various Network Address forms

• Static: an address written into a NIC’s ROM (read-only memory), the address is nonvolatile (that is, is not lost when the power is turned off) and permanent, set by the manufacturer.

• Configurable: an address written in EEPROM (Electrically Erasable Programmable Read-Only Memory).

CSIT 220 (Blum) 37

Various Network Address forms

• Configuarble (Cont.) – Programmable ROM can be written by user

instead of manufacturer, but is nonvolatile, semi-permanent.

– Network addresses can be assigned, rather than random MAC addresses.

• Dynamic: Network addresses set by software when the system boots (volatile, non-permanent).

CSIT 220 (Blum) 38

Pros and Cons

• Static– Pro: ease of use and permanence– Con: requires coordination among manufacturers– Pro: LAN administrators do not have to set

• Dynamic– Pro: one can choose “meaningful” addresses – Con: lack of permanence and potential conflict.

CSIT 220 (Blum) 39

Pros and Cons (Cont.)

• Configurable– Pro: addresses are semi-permanent, but

replacement hardware can be assigned MAC address of old hardware

– Pro: address can be smaller since it is unique on a specific LAN

– Con: LAN administrator has to set

CSIT 220 (Blum) 40

Broadcast

• In addition to bringing in messages whose destination address matches its MAC address, the NIC brings in messages that were “broadcast.”

• In networking, a broadcast message should be picked up by each node.

• A message with a single destination are said to be “unicast.”

CSIT 220 (Blum) 41

Multicast

• Intermediate between unicast and broadcast is multicast, in which a single message is transmitted to select group of receivers.– Source sends one message not N copies.

• On a different level, sending an e-mail message to a mailing list would be an example of multicasting

• Teleconferencing and videoconferencing also use multicasting, but require more robust protocols and networks.

CSIT 220 (Blum) 42

Narrowcast

• A related term is “narrowcast.”– Network TV broadcasts; anyone can receive their

signal. – Cable television narrowcasts; it has subscribers. – Push technologies also narrowcast.

• Allowing a company to send you email advertisements is an example of a push technology. One does not request (pull) each ad; rather it the company pushes the message on one.

CSIT 220 (Blum) 43

A matter of interpretation

• At the physical layer, the transmission is simply a signal.

• At the data link layer, the transmission is a string of 1’s and 0’s (bytes) that did or did not arrive error free.

• But the information is ultimately to be passed on to and interpreted by some application many layers higher in the communication protocol.

CSIT 220 (Blum) 44

Frames Revisited• The data portion of a frame (a.k.a. the payload)

may take on many forms (it may be intended for any number of applications) and the receiving computer must know the “type” of data coming in.

• Framing schemes fall into two categories – Explicit (self-identifying): the frame header has a type

field explicitly announcing the type of data. – Implicit (not self-identifying): there is no information in

the header, any data typing required must be contained in the payload itself.

CSIT 220 (Blum) 45

General Frame Format

Frame Header Frame Data Area or Payload

Typically has fixed size

Typically varies in size

CSIT 220 (Blum) 46

Ethernet Frame Format

Number of bytes

Is self-identifying

CSIT 220 (Blum) 47

Ethernet Frame Format (Cont.)

• Preamble: a pattern of 64 1’s and 0’s that ensure that the transmitter and receiver are synchronized (at the bit level and the byte level).

• Destination Address: the receiver’s physical (MAC) address from its NIC card.

• Source Address: the transmitter’s physical (MAC) address (so an acknowledgement can be sent).

CSIT 220 (Blum) 48

Ethernet Frame Format (Cont.)

• Frame Type: two bytes that identify the format/protocol of the data that follows (what application will deal with it).

• Data (Payload): 46 to 1500 bytes of the actual information one wanted to send in the first place.– Lower bound needed to guarantee reduce collisions.

• CRC: A 32-bit cyclic redundancy check to ensure the information was not corrupted during transmission.

CSIT 220 (Blum) 49

Some Ethernet Type Field Values

Value Meaning

0800 Internet IP Version 4

6559 Frame Relay

8008 AT&T Corporation

8014 Silicon Graphics Corporation network games

809B Apple Computer Corp. AppleTalk

80D5 IBM Corporation SNA

CSIT 220 (Blum) 50

Non Self-Identifying Frames

• In protocols that don’t have Data Type fields, there is one of two options – Sender and receiver must agree ahead of time

on the data type. – Sender and receiver must agree to use the first

part of the payload to serve in place of the data type field, to make up for this missing data type in the protocol.

CSIT 220 (Blum) 51

IEEE to the rescue

• The IEEE stepped in and set up a standard way to announce the Type in a protocol that did not have a Type field.

• LLC/SNAP Logical Link Control SubNetwork Attachment Point.

CSIT 220 (Blum) 52

LLC/SNAP

Octet = byte

OUI: Organizationally Unique Identifier

CSIT 220 (Blum) 53

Sniffer

• A sniffer, a.k.a. a network analyzer: A program that monitors data traveling over a network. – One does not need new hardware, a standard NIC can

be put into promiscuous mode in which it copies all packets instead of only those sent to it.

• It can be used as a legitimate network management tool, for instance, to troubleshoot network traffic problems.

• It can also be used for stealing information off a network.

CSIT 220 (Blum) 54

Hacker’s tool

• A sniffer is one of the hacker’s favorite tools. It can be used to intercept all sorts of data not intended to be seen by any but the destination computer. Suppose for instance that password used to log on to some remote site was sent un-encrypted

CSIT 220 (Blum) 55

Policing the network

• A sniffer can be used to determine if network users are sending or receiving packets considered forbidden on the network, e.g. suppose the network administrator outlaws the use of Napster, a sniffer could be used to catch those still using it.

CSIT 220 (Blum) 56

Other References

• http://www.webopedia.com

• http://www.whatis.com