Cisco Networking Pro & Network+

TCP/IP Model

• Application layer

• Transport layer

• Internet layer

• Link layer

TCP/IP Application Layer

• also called the Process-to-Process layer

• corresponds to the Session, Presentation, and Application layer of the OSI model

TCP/IP Transport Layer

• also called the Host-to-Hose layer

• comparable to the Transport layer of the OSI model

• responsible for error checking and reliable packet delivery

• breaks the data stream into segments and assigns sequence numbers so that the segments can be reassembled correctly at the destination

TCP/IP Internet Layer

• comparable to the Network layer of the OSI model

• responsible for moving packets through a network

• involves addressing and making routing decisions to identify how the packet traverses the network

TCP/IP Link Layer

• corresponds to the functions of the Physical and Data Link layers of the OSI model

• responsible for describing the physical layout of the network and how messages are formatted on the transmission medium

• sometimes divided into the Data Link and Physical layers

What is encapsulated into the data field of an Ethernet frame?

The Layer 3 PDU

What is the length restriction of the data field in an Ethernet frame?

Between 46 to 1500 bytes

Which Ethernet sublayer is used to control network access using CSMA/CD?

MAC

What addressing information is recorded by a switch to build its MAC address table?

The source Layer 2 address of incoming frames

What important information is examined in the Ethernet frame header by a Layer 2 device in order to forward the data onward?

The destination MAC address

What happens to runt frames received by a Cisco Ethernet switch?

The frame is dropped

What is indicated by the 100 in the 100BASE-T standard?

Megabits per second

Which three fields are found in an 802.3 Ethernet frame?

• The source physical address

• The frame check sequence

• The destination physical address

Which two characteristics describe Ethernet technology?

• It is supported by IEEE 802.3 standards

• It uses unique MAC addresses to ensure that data is sent to the appropriate destination

What will a host on an Ethernet network do if it receives a frame with a unicast destination MAC address that does not match its own MAC address?

It will drop the frame

Ethernet standards define both the Layer 2 protocols and the Layer 1 technologies

IEEE 802 LAN/MAN protocols, including Ethernet, use which two separate sublayers of the data link Layer to operate?

• Logical Link Control (LLC)

• Media Access Control (MAC)

LLC Sublayer

• IEEE 802.2 sublayer

• communicates between the networking software at the upper layers and the device hardware at the lower levels

• places information in the frame that identifies which network layer protocol is being used for the frame - allowing multiple Layer 3 protocols, such as IPv4 and IPv6, to use the same network interface and media

MAC Sublayer

• IEEE 802.3, 802.11, 802.15

• implemented in hardware and is responsible for data encapsulation and media access control

• provides data link layer addressing and is integrated with various physical layer technologies

In an Ethernet frame, what is the MAC sublayer is responsible for?

• Data encapsulation and accessing the media

Ethernet Frames - IEEE 802.3 MAC sublayer data encapsulation includes:

• Ethernet frame - the internal structure of the Ethernet frame

• Ethernet Addressing - the Ethernet frame includes both a source and destination MAC address to deliver the Ethernet frame from Ethernet NIC to Ethernet NIC on the same LAN

• Ethernet Error detection - the Ethernet frame includes a frame check sequence (FCS) trailer used for error detection

The IEEE 802.3 MAC sublayer includes the specifications for different Ethernet communications standards over various types of media including copper and fiber.

What is the minimum and the expected maximum Ethernet frame size?

64 bytes and 1518 bytes

What is included in the size of an Ethernet frame?

• all bytes from the destination MAC address field through the frame check sequence (FCS) field

What is not included in the size of the Ethernet frame?

• the preamble field

What is a considered a “collision fragment” or “runt frame”?

• any frame that is less than 64 bytes

• automatically discarded by receiving stations

What is considered a “jumbo” or “baby giant frames”?

• frames with more than 1500 bytes of data

If the size of a transmitted frame is less than the minimum, or greater than the maximum, what will the receiving device do with the frame?

• the receiving device will drop the frame

What size is the preamble and SFD? The Destination MAC address? The Source MAC address? The Type/Length? The data? The FCS?

• preamble is 7 bytes and the Start Frame Delimiter (SFD) is 1 bytes - 8 bytes

• destination MAC address - 6 bytes

• sources MAC address - 6 bytes

• type/length - 2 bytes

• data - 46 - 1500 bytes

• FCS - 4 bytes

Describe the Preamble and Start Frame Delimiter Ethernet frame field

• the Preamble is 7 bytes

• SFD is 1 byte

• used for synchronization between the sending and receiving devices

• used to get the attention of the receiving nodes

• tells the receivers to get ready to receive a new frame

Describe the Destination MAC Address Ethernet frame field

• 6 bytes

• the identifier for the intended receipient

• the destination MAC address is used by Layer 2 assist devices in determining if a frame is addressed to them

• the address in the frame is compared to the MAC address in the device

  • if there is a match, the device accepts the frame

• can be a unicast, multicast, or broadcast address

Describe the Source MAC Address Ethernet frame field

• 6 bytes

• identifies the originating NIC or interface of the frame

Describe the Type/Length Ethernet frame field

• 2 bytes

• identifies the upper layer protocol encapsulated in the Ethernet frame

• common values are, in hexadecimal, 0×800 for IPv4, 0×86DD for IPv6 for ARP

• EtherType, Type, Length

Describe the Data Ethernet frame field

• 46 - 1500 bytes

• contains the encapsulated data from a higher layer, a generic Layer 3 PDU, or more commonly, an IPv4 packet

• all frames must be at least 64 bytes long

• if a small packet is encapsulated, additional bits called a pad are used to increase the size of the frame to the minimum size

Describe the Frame Check Sequence (FCS) Ethernet frame field

• 4 bytes

• used to detect errors

• uses a cyclic redundancy check (CRC)

• the sending device includes the results of a CRC in the FCS field of the frame

• the receiving device receives the frame and generates a CRC to look for errors

• if the calculations match, no error occured

• calculations that don’t match are an indication that the data has changed; therefore, the frame is dropped

• a change in the data could be the result of a disruption of the electrical signals that represent the bits

Which part of an Ethernet frame uses a pad to increase the frame field to at least 64 bytes?

• the Data field

Which part of an Ethernet frame detects errors in the frame?

• the Frame Check Sequence

Which part of an Ethernet frame describes the higher-layer protocol that is encapsulated?

• EtherType

Which part of an Ethernet frame notifies the receiver to get ready for a new frame?

• Preamble

Which data link sublayer controls the network interface through software drivers?

• LLC

Which data link sublayer works with the upper layers to add application information for delivery of data to higher level protocols?

• LLC

What is a function of the MAC sublayer?

• controls access to the media

• checks for errors in received bits

• uses CSMA/CD or CSMA/CA to support Ethernet technology

Describe a Unicast MAC address

• the unique address that is used when a frame is sent from a single transmitting device to a single destination device

• for a unicast packet to be sent and received, a destination IP address must be in the IP packet header

• a corresponding destination MAC address must also be present in the Ethernet frame header

• the IP address and MAC address combine to deliver data to one specific destination host

• ARP (Address Resolution Protocol) is the process that a source host uses to determine the destination MAC address associated with an IPv4 address

• ND (Neighbor Discovery) is the process that a source host uses to determine the destination MAC address associated with an IPv6 address

• the source MAC address must always be a unicast

Describe a Multicast MAC address

• received and processed by every device on the Ethernet LAN

• has a destination MAC address of FF-FF-FF-FF-FF-FF in hexadecimal (48 ones in binary)

• is flooded out all Ethernet switch ports except the incoming port

• is not forwarded by a router

• if the encapsulated data is an IPv4 broadcast packet, the packet contains a destination IPv4 address that has all ones in the host portion

  • this numbering in the address means that all hosts on that local network (broadcast domain) will receive and process the packet

• DHCP is a protocol that uses Ethernet and IPv4 broadcast addresses

• not all Ethernet broadcasts carry an IPv4 broadcast packet

  • ARP requests don’t use IPv4, but the ARP message is sent as an Ethernet broadcast

Describe a Broadcast MAC address

• received and processed by a group of devices on the Ethernet LAN that belong to the same multicast group

• there is a destination MAC address of 01-00-5E when the encapsulated data is an IPv4 multicast packet and a destination MAC address of 33-33 when the encapsulated data is an IPv6 multicast packet

• are other reserved multicast destination MAC addresses for when the encapsulated data is not IP, such as Spanning Tree Protocol (STP) and Link Layer Discovery Protocol (LLDP)

• is flooded out all Ethernet switch ports except the incoming port, unless the switch is configured for multicast snooping

• is not forwarded by a router, unless the router is configured to route multicast packets

• if the encapsulated data is an IP multicast packet, the devices belonging to a multicast group are assigned a multicast group IP address

• IPv4 multicast addresses → 224.0.0.0 to 239.255.255.255

• IPv6 multicast addresses begin with ff00::/8

• can only be used as the destination of a packet because multicast addresses represent a group of addresses (host group)

• the source will always be a unicast address

• the multicast IP address requires a corresponding multicast MAC address to deliver frames on a local network

• the multicast MAC address is associated with, and uses addressing information form, the IPv4 and IPv6 multicast address

• used by routing protocols and other network protocols

• applications such as video and imaging software may also use multicast addressing

  • multicast applications are not as common

What does a Layer 2 Ethernet switch use to make forwarding decisions? Explain.

• Layer 2 MAC addresses

• completely unaware of the data (protocol) being carried in the data portion of the frame, such as an IPv4 packet, an ARP message, or an IPv6 ND packet

• the switch makes its forwarding decisions bases solely on the Layer 2 Ethernet MAC addresses

• it examines is MAC address table to make a forwarding decision for each frame

• dynamically builds the MAC address table by examining the source MAC address of the frames received on a port

• forwards frames by searching for a match between the destination MAC address in the frame and an entry in the MAC address table

• every frame that enters a switch is checked for new information to learn by examining the source MAC address of the frame and the port number where the frame entered the switch

  • if the source MAC address does not exist, it is added to the table along with the incoming port number

  • if the source MAC address does exist, the switch updates the refresh timer (5 min. by default for most Ethernet switches) for that entry in the table

• if the source MAC address does exist in the table but on a different port, the switch treats this as a new entry and the entry is replaced using the same MAC address but with the more current port number

• As a switch receives frames from different devices, it is able to populate its MAC address table by examining the source MAC address of every frame. When the MAC address table of the switch contains the destination MAC address, it is able to filter the frame and forward out a single port

• can have multiple MAC addresses associated with a single port

  • common when a switch is connected to another switch

  • the switch will have a separate MAC address table entry for each frame received with a different source MAC address

• When a device has an IP address that is on a remote network, the Ethernet frame cannot be sent directly to the destination device

  • the Ethernet frame is sent to the MAC address of the default gateway, the router