- Alright, we're going to talk
first a little bit about Ethernet.
I'm going to give you a little bit of a history lesson
for those of you who have not seen this before.
It may be interesting to you, may not be.
We'll just go into this.
We all know Ethernet, right?
We have these at home.
We have our routers at home
that you plug your connections into.
You got your wi-fi router.
Really what it was based on was all based on Ethernet.
Ethernet was actually invented by Xerox
at their Palo Alto research center, or PARC, in the 1970s.
It used to run at three megabits per second.
Then, Xerox, Digital Equipment, and Intel got together,
that's the DIX standard,
and they bumped the speed up to ten megabits.
They actually standardized it in 1978.
This was passed over in 1980 with the IEEE,
that's the Institute of Electrical
and Electronics Engineers.
They released a compatible version
of the standard that looks very much like Ethernet.
There is a little bit of a difference in there
and that they use a Link Field instead of a Type Field,
which we'll get into.
This version of the standard is what we all know as 802.3.
Give a little bit of history.
We're gonna talk about the original version of the standard,
which was called 10Base5.
That is 10 megabits per second,
that's what the 10 stands for.
Base is baseband.
5 is the distance in meters.
So that's 500 meters.
Originally the way it was set up,
is they had this very, very thick orange cable,
very thick, with coaxial cable.
On either side you had a terminator. A 50 Ohm terminator.
That terminator sometimes was a source of problems
if the terminator was not on correctly
you have to ground one side, you don't ground both sides,
you had to ground one side of the cable.
Then attached to this, almost like this frozen garden hose,
you have a transceiver.
The transceiver attaches to the cable,
and coming off of the transceiver
is a Vampire Tap that attaches to the cable.
Then you have an AUI, or an Attachment User Interface cable
that goes to the NIC and onto the Host.
Originally, you could have up to a hundred machines
that were on a segment.
If you wanted to add more users than a hundred,
you would have to do some kind of a repeater
or start setting up things, like bridges,
which we'll get into.
This is the original Ethernet device, or Ethernet design.
It was usually run in a false ceiling.
Then they had a transceiver that was connected
down to the host.
To put everything together, you have your 10Base5 LAN.
You have your transceivers that are attached to the LAN.
Then your Host that are attached to the transceivers.
When a host wants to send, it will listen to the network
to make sure that nobody else is sending at the same time.
That method is called Carrier-Sense Multiple Access
with Collision Detection.
That's the Media Access Control method
that is used in early Ethernet networks.
It is a Broadcast Multiple Access network.
Even when you're only sending from one device
to another device, you're actually broadcasting
across the entire network.
And then each Host, we'll look in the frame
and look at a field called the Destination Address.
It will see whether or not that Destination Address
matches up with that device.
If it does, it takes the frame in
and then interrupts the CPU on the Host
and copies that frame across to the Host.
Every Host on the Ether receives that same copy.
If a Host wants to send to multiple destinations,
we have a broadcast address that we can send.
Every device that is attached to this
has a Burned-In Address,
it's called the Burned-In Address,
that is burned into each Mac.
That is usually called a Mac Address.
This makes this whole network Half Duplex.
Half Duplex meaning we can send or receive at the same time.
This is called a Collision Domain.
What a collision is, is when two devices listen
to the medium at the same time
and they realize that the medium is free
then they will start sending at the same time.
They will transmit over each other
and that's called a Collision.
The transceivers will detect that collision by more voltage,
because that's additive between two devices
and you'll get more voltage on the line
than you should expect.
And that's called a Collision.
At the same time, we have a geographic distance.
We're limited to no more than 500 meters.
As a matter of fact, it's usually much less than that.
And the Host count is much less than that.
Because you have this huge cable that's snaking through
the ceiling of your areas, so this short coming
led to using RG-58/U cable.
This is also a 50 cable.
It's much, much thinner.
It's the 10Base2.
Finally, what we're all used to,
which is our twisted pair 10BaseT and that's using hubs.
Getting into Hubs, this is the repeater or a hub.
This operates at Layer One of the OSI reference model.
All it is, is whenever it gets a frame that comes in,
it will repeat that frame at all ports
except for the port that it came in on.
They do not filter or modify the frames
in any way other than just to regenerate the signals.
It's still a Single Collision Domain.
If you send and another station sends at the same time,
you will have collisions
except the hub now is responsible for detecting
those collisions and sending the signal back.
Usually the way it sends a signal back
is it will repeat the frame back out on the same port
that it came in on.
At the same time you're sending and you're listening
at the same time and if you get a frame that comes back,
then you know you had a collision and you have to re-send.
It's least secure, right?
Hubs repeat frames to all ports.
If you get a frame that comes in,
it gets copied out to all destination ports
regardless of the address that's on the frame.
If you put your device into what's called Promiscuous Mode,
then you will receive frames that are not addressed.
The Host will actually receive that frame
and it'll interrupt the CPU for frames
that are not address to them,
their burned-in address by using the promiscuous mode.
Because of their short comings with collision domains,
the single collision domain,
The IEEE actually deprecated their use in 2011,
which made them obsolete.
So you don't see them very often any more.
This is the Ethernet frame.
We're still talking about the physical layer.
This is the Bits and Layer Two,
which is the Data Link Layer.
Then we have the Ethernet Frame.
We start out with the destination going all the way across.
You might not have seen this terminology used before.
Sometimes networking people,
we tend to use our own little lingo.
The lingo that networking people use
when you're talking about bytes,
what we normally think of a byte is they use octets.
Octets are technically more correct.
What they refer to are eight bits of data is an octet.
A byte may be more ambiguous.
There were some devices that they had,
maybe had seven bit bytes or maybe they had five bit bytes.
So Octet is eight bits.
That's typically what we'll use
when we're talking about networking.
One of the things that you really want to understand
is that you can't just continually transmit on a network.
You have to limit on how much you can send.
This is called the Maximum Transmission Unit.
When you're talking about Ethernet,
the limit for Ethernet
is typically 1500 Octets, or 1500 Bytes.
That is as much as you can send.
If you want to send more than that,
you have to break up your communication
into multiple frames.
Typically, your Layer Three protocols
will take care of that for you.
Starting with the Destination Mac Address,
this is six octets.
The Destination Mac Address
indicates where this frame is being sent to.
Six octets is 48 Bits.
That's how large a Layer Two Mac Address normally is.
48 Bits.
We'll see how those are broken up later on.
Every frame that's being sent has a source.
The device will indicate where that frame is coming from.
This information is used by Switches,
which we'll get into later on,
to figure where packets or frames,
in this case, are actually coming from.
Following that, we have a Type or a Length Field.
Remember when I was telling you before,
that a Type was Ether type.
This was the original Ethernet.
There are some cases where you may not have a protocol
that can say exactly what it's length is.
That's if you were doing Layer Three for instance.
In those cases you may need a Length Field.
The reason why is because Ethernet
has a minimum payload size and that is 46 octets.
If you have less than 46 octets to send,
you have to pad that out to be able to send.
The reason why they do that is so you can detect collisions.
That's why it was there.
That's called a Slap Time of Ethernet.
In the cases where you have less then 46 Bites to send,
you may need a length.
That's what the length field in used for.
We just usually use it as a Type Indicator that says
"This payload is either going to be IP.
"It can be IPV-6, it can be ARP."
Which is the Address Resolution Protocol.
Those are all indicated by their own Ethertypes.
To follow that up, we've had the Payload,
which we've talked about.
Finally we have the Frame Check Sequence.
This is a Cyclic Redundancy Check,
which is kind of like a Check Sum,
that says whether or not we had any errors in this frame.
You send the frame with the payload with the FCS,
and then the FCS is computed at the Destination Station.
If they match, then you know that the packet
was sent without any errors.
Finally there's some things that you may not know
is that there is something called a Preamble
and Start Frame Delimiter in Ethernet.
The Preamble is a one-zero-one-zero-one-zero pattern,
and then the Start Frame Delimiter is two trailing ones.
So it'll go one-zero-one-zero-one-one
and that lets you know that the station
that's receiving the packet,
when the Destination Mac Address starts.
They do this for syncing up timing.
Finally we have the Interpacket Gap.
Also called the Interframe Gap and this is 12 octets.
You can't just also continuously blast frames
out on the network.
You have to have some kind of a pause, and that's 12 octets.
So talking a little bit more about Layer Two addressing.
Interfaces are configured with a Burned-In Mac Address.
NICS will not interrupt the host for
Destination Mac Addresses that do not match this interface,
but there are some exceptions to this.
We have a Broadcast Destination Mac Address.
That's all ones.
What they're signifying is ff-ff-ff all the way across.
It's in hexadecimal format. That's why it's UCFs.
There's also things called Multi-Cast Addresses,
which as well will be forwarded to multiple devices.
Remember this is a broadcast multiple access medium
where you can send one frame and that ends up getting copied
to multiple devices at the same time.
If you wanted to receive frames
that are not destined for an interface,
you can set the interface to Promiscuous Mode.
In this case, I'm using the IP Link Set Command,
Ethernet 2, which is my interface, Promiscuous on.
When I do IP Link show Ethernet 2,
you can see that it's in Promiscuous Mode.
Packet Capture Software like Wireshark
or TShark that does this by default for you.
You shouldn't have to worry
about putting in interface in Promiscuous Mode.
I will say, though, that when you put Interface
in Promiscuous Mode, it will make an event
in the Kernel Log.
You will know from looking at the log of the system
that you're currently on that you
were going into promiscuous mode.
If you were on a device that,
maybe you don't completely control,
maybe there's an administrator that is monitoring that,
they could see that when you go in to Promiscuous Mode.
Next slide, we'll talk a little bit about Mac Adresses.
This is the 48 Bit hexadecimal format layer to address.
The first 24 bits are the manufacture ID.
This is signed by the IEEE.
In this case I have an OUI.
That's called the Organizational Unique Identifier,
is the manufacture ID.
In this case, I'm showing Cisco
is one of their assigned identifiers
that's all zeros with a C.
That's pretty easy to remember.
The second 24 bit is the specific interface
that is assigned by the manufacturer.
Keep in mind, this is not per host this is per interface.
If you have a device with multiple interfaces,
for instance a router,
you will have multiple Mac Addresses
that are assigned one to each interface.
The Group Bit, which is a bit
that is in the manufacturer ID.
This indicates that it is a multicast frame.
When you have a manufacturer ID
that is assigned by the IEEE,
you're actually being given a unicast
and a multicast group of addresses that you can use.
Finally all ones is broadcast.
You'll notice that I'm using hyphens
in between each individual eight bit piece
of the Mac Address.
This is called Canonical Format.
It's not really important
but sometimes you'll see the Mac Addresses
indicated by colons.
That is a non-canonical format.
The difference between a canonical
and the non-canonical format
are for some of the other IEEE LANs like Token Ring.
The hyphens are technically more correct,
but if you see colons, it's usually just fine.
That is the non-canonical format.
Bridges and Switches.
Switches create a broadcast domain
from a collection of individual LAN segments.
What does that mean?
You have Collision Domains.
These are where you would normally have
your listening as you send.
Switches actually break that up.
In the case of a Switch, you could send
and receive at the same time.
They call this Full Duplex.
What Switches do is they learn,
filter and forward frames based on the source
and destination Mac Address.
Switches themselves can be internally partitioned
using Virtual LANs or VLANs.
These can be carried externally
outside the switch using 802.1Q tagging.
They call this tagging frames or tagged frames.
Cisco sometimes calls these "Trunks".
If you've ever heard of a trunk going between two Switches,
you'll know that you have multiple VLANs
that are being carried across that individual LAN segment.
If you have a frame that's coming in on, let's say VLAN10,
you can have a tag that goes out across that trunk saying
"This is actually for VLAN10."
So then the receiving Switch sees that tag,
it will know that it needs to go only to VLAN10
and not to any other VLANs that are on the switch.
Keep in mind also that some Switches are routers as well.
In this example, I'm using just Switching
based on Layer Two.
But some devices can do Switching at Layer Three.
In those cases, they are routers.
They do Layer Three routing.
They have a routing protocol that they may speak.
To learn routes we'll get into routers
a little bit later on.