Ethernet was originally developed by Digital, Intel and Xerox (DIX) in the early 1970's and has been designed as a 'broadcast' system, i.e. stations on the network can send messages whenever and wherever it wants. All stations may receive the messages, however only the specific station to which the message is directed will respond.

The original format for Ethernet was developed in Xerox Palo Alto Research Centre (PARC), California in 1972. Using Carrier Sense Multiple Access with Collision Detection (CSMA/CD) it had a transmission rate of 2.94Mb/s and could support 256 devices over cable stretching for 1km. The two inventors were Robert Metcalf and David Boggs.

Ethernet versions 1.0 and 2.0 followed until the IEEE 802.3 committee re-jigged the Ethernet II packet to form the Ethernet 802.3 packet. (IEEE's Project 802 was named after the time it was set up, February 1980. It includes 12 committees 802.1 to 802.12, 802.2 is the LLC, 802.4 Token Bus, 802.11 Wireless, 802.12 100VG-AnyLAN etc.) Nowadays you will see either Ethernet II (DIX) (invented by Digital, Intel and Xerox) format or Ethernet 802.3 format being used.

The 'Ether' part of Ethernet denotes that the system is not meant to be restricted for use on only one medium type, copper cables, fibre cables and even radio waves can be used.

10Base5

The cable is run in one long length forming a 'Bus Topology'. Stations attach to it by way of inline N-type connections or a transceiver which is literally screwed into the cable (by way of a 'Vampire Tap') providing a 15-pin AUI (Attachment Unit Interface) connection (also known as a DIX connector or a DB-15 connector) for a drop lead connection (maximum of 50m length) to the station. The segments are terminated with 50 ohm resistors and the shield should be grounded at one end only.

All 802.3 implementations use Manchester encoding. A transition in the middle of each bit makes it possible to synchronize the sender and receiver. At any instant the ether can be in one of three states: transmitting a 0 bit (-0.85v), transmitting a 1 bit (0.85v) or idle (0 volts).

5-4-3 Rule

The segment could be appended with up to a maximum of 4 repeaters, therefore 5 segments (total length of 2,460m) can be connected together. Of the 5 segments only 3 can have devices attached (100 per segment). A total of 300 devices can be attached on a Thicknet broadcast domain.

10Base2

• RG-58 /U - solid copper core (0.66mm or 0.695mm), 53.5 ohms.
• RG-58 A/U - stranded copper core (0.66mm or 0.78mm), 50 ohms.
• RG-58 C/U - military version of RG58 A/U (0.66mm), 50 ohms.
• RG-59 - broadband transmissions e.g. cable TV.
• RG-6 - higher frequency broadband transmissions. A larger diameter than RG-59.
• RG-62 - ArcNet.
• RG-8 - Thicknet, 50 ohms.

Each station connects to the thinnet by way of a Network Interface Card (NIC) which provides a BNC (British Naval Connector). At each station the thinnet terminates at a T-piece and at each end of the thinnet run (or 'Segment') a 50-ohm terminator is required to absorb stray signals, thereby preventing signal bounce. The shield should be grounded at one end only.

A segment can be appended with other segments using up to 4 repeaters, i.e. 5 segments in total. 2 of these segments however, cannot be tapped, they can only be used for extending the length of the broadcast domain (to 925m). What this means is that 3 segments with a maximum of 30 stations on each can give you 90 devices on a Thinnet broadast domain.

(There is also a little used 10Broad36 standard where 10MHz Ethernet runs over broadband).

10BaseT

The wires used in the RJ45 are 1 and 2 for transmit, 3 and 6 for receive.

In order to connect to ethernet in this 'Star Topology', each station again has a NIC which, this time, contains an RJ45 socket which is used by a 4-pair RJ45 plug-ended droplead to connect to a nearby RJ45 floor or wall socket.

Each port on the hub sends a 'Link Beat Signal' which checks the integrity of the cable and devices attached, a flickering LED on the front of the port of the hub tells you that the link is running fine. The maximum number of hubs (or, more strictly speaking, repeater counts) that you can have in one segment is 4 and the maximum number of stations on one broadcast domain is 1024.

Signal Quality Error (SQE)

The SQE test or 'heartbeat' is a test signal generated on the cable after every transmission to assess the ability of the transceiver to detect collisions. Ethernet 1.0 did not have this in its standard and 802.3 says that repeaters must not connect to a transceiver that generates the SQE test because of the Jam signal that is designed to prevent redundant collisions from occurring. The option is normally available to turn off SQE test for this reason.

The advantages of the UTP/STP technology are gained from the flexibility of the system, with respect to moves, changes, fault finding, reliablity and security.

The following table shows the RJ45 pinouts for 10BaseT:

If you wish to connect hub to hub, or a PC directly then the following 10BaseT cross-over cable should be used:

The 4 repeater limit manifests itself in 10/100BaseT environments where the active hub/switch port is in fact a repeater, hence the name multi-port repeater. Generally, the hub would only have one station per port but you can cascade hubs from one another up to the 4 repeater limit. The danger here of course, is that you will have all the traffic from a particular hub being fed into one port so care would need to be taken on noting the applications being used by the stations involved, and the likely bandwidth that the applications will use.

There is a semi-standard called Lattisnet (developed by Synoptics) which runs 10MHz Ethernet over twisted pair but instead of bit synchronisation occurring at the sending (as in 10BaseT) the synchronisation occurs at the receiving end.

10BaseF

The 10BaseF standard developed by the IEEE 802.3 committee defines the use of fibre for ethernet. 10BaseFB allows up to 2km per segment (on multi-mode fibre) and is designed for backbone applications such as cascading repeaters. 10BaseFL describes the standards for the fibre optic links between stations and repeaters, again allowing up to 2km per segment on multi-mode fibre. In addition, there is the 10BaseFP (Passive components) standard and the FOIRL (Fibre Optic Inter-Repeater Link) which provides the specification for a fibre optic MAU (Media Attachment Unit) and other interconnecting components.

The 10BaseF standard allows for 1024 devices per network.

CSMA/CD

As mentioned earlier, Ethernet uses Collision Sense Multiple Access with Collision Detection (CSMA/CD). When an Ethernet station is ready to transmit, it checks for the presence of a signal on the cable. If no signal is present then the station begins transmission, however if a signal is already present then the station delays transmission until the cable is not in use. If two stations detect an idle cable and at the same time transmit data, then a collision occurs. On a star-wired UTP network, if the transceiver of the sending station detects activity on both its receive and transmit pairs before it has completed transmitting, then it decides that a collision has occurred. On a coaxial system, a collision is detected when the DC signal level on the cable is the same or greater than the combined signal level of the two transmitters, i.e.. significantly greater than +/- 0.85v. Line voltage drops dramatically if two stations transmit at the same and the first station to notice this sends a high voltage jamming signal around the network as a signal. The two stations involved with the collision lay off transmitting again for a time interval which is randomly selected. This is determined using Binary Exponential Backoff. If the collision occurs again then the time interval is doubled, if it happens more than 16 times then an error is reported.

A Collision Domain is that part of the network where each station can 'see' other stations' traffic both unicast and broadcasts. The Collision Domain is made up of one segment of Ethernet coax (with or without repeaters) or a number of UTP shared hubs. A network is segmented with bridges (or microsegmented when using switches) that create two segments, or two Collision Domains where a station on one segment can not see traffic between stations on the other segment unless the packets are destined for itself. It can however still see all broadcasts as a segmented network, no matter the number of segments, is still one Broadcast Domain. Separate Broadcast Domains are created by VLANs on switches so that one physical network can behave as a number of entirely separate LANs such that the only way to allow stations on different VLANs to communicate is at a layer 3 level using a router, just as if the networks were entirely physically separate.

The InterPacket Gap (IPG) is the fixed time gap between Ethernet Frames. This is set at 9.6 micro seconds.

Promiscuous mode is used by special network adaptors used in devices such as network analysers and transparent bridges. What happens is that the network controller passes ALL frames up to the upper layers regardless of destination address. Normally the frames are only passed up if they have that particular device's address.

Full-Duplex Ethernet can exist between switch ports only and uses one pair of wires for transmit and one pair for receive. NICs for 10BaseT, 10BaseFL, 100BaseFX and 100BaseT have circuitry within them that allows full-duplex operation and bypasses the normal loopback and CSMA/CD circuitry. Collision detection is not required as the signals are only ever going one way on a pair of wires. In addition, Congestion Control is turned on which 'jams' further data frames on the receive buffer filling up.

Half-Duplex allows data to travel in only one direction at a time. Both stations use CSMA/CD to contend the right to send data. In a Twisted Pair environment when a station is transmitting, its transmit pair is active and when the station is not transmitting it's receive pair is active listening for collisions.

Frame Formats

The diagrams below describe the structure of the DIX (Ethernet II) and the 802.3 Ethernet frames. The numbers above each field represent the number of bytes.

• Preamble field: Establishes bit synchronisation and transceiver conditions so that the PLS circuitry synchs in with the received frame timing. The DIX frame has 8 bytes for the preamble rather than 7, as it does not have a Start Frame Delimiter (or Start of Frame).
• Start Frame Delimiter: Sequence 10101011 in a separate field, only in the 802.3 frame.
• Destination address: Hardware address (MAC address) of the destination station (usually 48 bits i.e. 6 bytes).
• Source address: Hardware address of the source station (must be of the same length as the destination address, the 802.3 standard allows for 2 or 6 byte addresses, although 2 byte addresses are never used, N.B. Ethernet II can only uses 6 byte addresses).
• Type: Specifies the protocol sending the packet such as IP or IPX (only applies to DIX frame).
• Length: Specifies the length of the data segment, actually the number of LLC data bytes, (only applies to 802.3 frame and replaces the Type field).
• Pad: Zeros added to the data field to 'Pad out' a short data field to 46 bytes (only applies to 802.3 frame).
• Data: Actual data which is allowed anywhere between 46 to 1500 bytes within one frame.
• CRC: Cyclic Redundancy Check to detect errors that occur during transmission (DIX version of FCS).
• FCS: Frame Check Sequence to detect errors that occur during transmission (802.3 version of CRC). This 32 bit code has an algorithm applied to it which will give the same result as the other end of the link, provided that the frame was transmitted successfully.

From the above we can deduce that the maximum 802.3 frame size is 1518 bytes and the minimum size is 64 bytes. Packets that have correct CRC's (or FCS's) but are smaller than 64 bytes, are known as 'Runts'.

Some discussion is warranted on the LLC field. The 802.2 committee developed the Logical Link Control (LLC) to operate with 802.3 Ethernet as seen in the above diagram. Whereas Ethernet II (2.0) combines the MAC and the Data link layers restricting itself to connectionless service in the process, IEEE 802.3 separates out the MAC and Data Link layers. 802.2 (LLC) is also required by Token Ring and FDDI but cannot be used with the Novell 'Raw' format. There are two types of LLC, Type 1 which is connectionless and Type 2 which is connection-oriented.

The Service Access Point (SAP) is used to distinguish between different data exchanges on the same end station and basically replaces the Type field for the older Ethernet II frame. The Source Service Access Point (SSAP) sends the LLC data unit and the Destination Service Access Point (DSAP) receives the LLC data unit. NetBIOS uses the SAP address of F0 whilst TCP uses the SAP address of 06. The Control Field identifies the type of LLC (Type 1 (uses a value of 03) or 2) and maintains the sequence numbers during transmission.

I/G and U/L within the MAC address

With an Ethernet MAC address, the first octet uses the lowest significant bit as the I/G bit (Individual/Group address) only and does not have such a thing as the U/L bit (Universally/Locally administered). The U/L bit is used in Token Ring A destination Ethernet MAC address starting with the octet '05' is a group or multicast address since the first bit (LSB) to be transmitted is on the right hand side of the octet and is a binary '1'. Conversely, '04' as the first octet indicates that the destination address is an individual address. Of course, in Ethernet, all source address will have a binary '0' since they are always individual.

The first 3 octets of the MAC address form the Organisational Unique Identifier (OUI) assigned to organisations that requires their own group of MAC addresses. A list of OUIs can be found at OUI Index.

Subnetwork Access Protocol (SNAP)

The SNAP protocol was introduced to allow an easy transition to the new LLC frame format for vendors. SNAP allows older frames and protocols to be encapsulated in a Type 1 LLC header so making any protocol 'pseudo-IEEE compliant'. SNAP is described in RFC 1042. The following diagram shows how it looks:

As you can see, it is an LLC data unit (sometimes called a Logical Protocol Data Unit (LPDU)) of Type 1 (indicated by 03). The DSAP and SSAP are set to AA to indicate that this is a SNAP header coming up. The SNAP header then indicates the vender via the Organisational Unique Identifier (OUI) and the protocol type via the Ethertype field. In the example above we have the OUI as 00-00-00 which means that there is an Ethernet frame, and the Ethertype of 08-00 which indicates IP as the protocol. More and more vendors are moving to LLC1 now but the usefulness of SNAP still remains and crops up time and time again.

Propagation Delay

Propagation Delay, or Latency, is the time taken for a frame to traverse the media from the sending station to the receiving station. A 64 byte frame takes 51.2 microseconds to travel between stations, a 512 byte frame takes 410 microseconds and a 1512 byte frame takes 1214 microseconds, provided that there are no other devices between the stations. This marries with the fact that 10,000 bits traverse the network in 1 second. A bridge would typically add 300 microseconds to the latency to the network.

The Path Delay Value is the time it takes an Ethernet frame to travel the furthest distance across the network. It is made up of the sum of the Link Segment Delay Values (LSDV) plus the repeater and DTE delays and maybe some safety margin.

Error Conditions

Runt

A Runt is a complete frame that is shorter than 64 bytes (512 bits), which is the smallest allowable frame. It can be caused by a collision, dodgy software or a faulty port/NIC.

Long

This is a frame that is between 1518 and 6000 bytes long. Normally it is due to faulty hardware or software on the sending station.

Giant

This is a frame that is between more than 6000 bytes long. Normally it is due to faulty hardware or software on the sending station.

Dribble

A frame that is defined as a 'dribble' is one that is greater than 1518 bytes but can still be processed. This could point to a problem where the IPG is too small or non-existent such that two frames join together.

Jabber

This is when a device is having problems electrically. Ethernet relies on electrical signalling to determine whether or not to send data, so a faulty card could stop all traffic on a network as it sends false signals causing other devices to think that the network is busy. This shows itself as a long frame with an incorrect FCS or is an alignment error.

Frame Check Sequence (FCS) Error

This defines a frame which may or may not have the right number of bits but they have been corrupted between the sender and receiver, perhaps due to interference on the cable.

Alignment Error

Frames are made up of a whole number of octets. If a frame arrives with part of an octet missing, and it has a Frame Check Sequence (FCS) error, then it is deemed to be an Alignment Error. This points to a hardware problem, perhaps EMF on the cable run between sender and receiver.

Broadcast Storm

An incorrect packet broadcast onto a network that causes multiple stations to respond all at once, typically with equally incorrect packets which causes the storm to grow exponentially in severity. When this happens there are too many broadcast frames for any data to be able to be processed. Broadcast frames have to be processed first by a NIC above any other frames. The NIC filters out unicast packets not destined for the host but multicasts and broadcasts are sent to the processor. If the broadcasts number 126 per second or above then this is deemed to be a broadcast storm. An acceptable level of broadcasts is often deemed to be less than 20% of received packets although many networks survive well enough on higher levels than this. The performance lower-specified workstations may be impacted by as little as 100 broadcasts/second. Some broadcast/multicast applications such as video conferencing and stock market data feeds can issue more than 1000 broadcasts/sec.

Collisions

Collisions are a normal occurrence on an Ethernet network. The more devices there are within a segment (Collision Domain) the more collisions are likely. A badly cabled infrastructure can cause unnecessary collisions due to a device being unable to sense a carrier and transmitting anyway.

If a collision rate is greater than 50% then it may be worth while considering segmenting the network by way of a bridge or router. This reduces the chance of a collision occurring on each of the segment thereby releasing more bandwidth for real traffic.

A Late Collision occurs when two devices transmit at the same time without detecting a collision. This could be because the cabling is badly installed (e.g. too long) or there are too many repeaters. If the time to send the signal from one end of the network to the other is longer than it takes to put the whole frame on to the network then neither device will see that the other device is transmitting until it is too late. The transmitting station distinguishes between a normal and a late collision by virtue that a late collision is detected after the time it takes to transmit 64 bytes. This means that a late collision can only be detected with frames of greater size than 64 bytes, they still occur for smaller frames but remain undetected and still take up bandwidth. Frames lost through late collisions are not retransmitted.

Excessive Collisions describe the situation where a station has tried 16 times to transmit without success and discards the frame. This means that there is excessive traffic on the network and this must be reduced.

For normal Ethernet traffic levels, a good guideline is if the number of deferred transmissions and retransmissions together make up for less than 5% of network traffic, then that is considered healthy.

A transmitting station should see no more than two collisions before transmitting a frame.

Jam

On detection of a collision, the NIC sends out a Jam signal to let the other stations know that a collision has occurred. A repeater, on seeing a collision on a particular port, will send a jam on all other ports causing collisions and making all the stations wait before transmitting. A station must see the jam signal before it finishes transitting the frame otherwise it will assume that another station is the cause of the collision.

100VG-AnyLAN

Based on 802.12 (Hewlett Packard), 100VG-AnyLAN uses an access method called Demand Priority. This is where the repeaters (hubs) carry out continuous searches round all of the nodes for those that wish to send data. If two devices cause a 'contention' by wanting to send at the same time, the highest priority request is dealt with first, unless the priorities are the same, in which case both requests are dealt with at the same time (by alternating frames). The hub only knows about connected devices and other repeaters so communication is only directed at them rather than broadcast to every device in the broadcast domain (which could mean 100's of devices!). This is a more efficient use of the bandwidth.

All four pairs of UTP are used, 25MHz signalling on each, allowing transmit and receive to occur at the same time. The longest cable run is 250m.

100BaseT

Fast Ethernet is the most popular of the newer standards and is an extension to 10BaseT, using CSMA/CD (802.3u). The '100' denotes 100Mb/s data speed and it uses the same two pairs as 10BaseT (1 and 2 for transmit, 3 and 6 for receive) and must only be used on Category 5 UTP cable installations with provision for it to be used on Type 1 STP. The Copper physical layer being based on the Twisted Pair-Physical Medium Dependent (TP-PMD) developed by ANSI X3T9.5 committee. The actual data throughput increases by between 3 to 4 times that of 10BaseT.

Whereas 10BaseT uses Normal Link Pulses (NLP) for testing the integrity of the connection, 100BaseT uses Fast Link Pulses (FLP) which are backwardly compatible with NLPs but contain more information. FLPs are used to detect the speed of the network (e.g. in 10/100 switchable cards and ports).

The ten-fold increase in speed is achieved by reducing the time it takes to transmit a bit to a tenth that of 10BaseT. The slot-time is the time it takes to transmit 512 bits on 10Mbps Ethernet (i.e. 5.12 microseconds) and listen for a collision (see earlier). This remains the same for 100BaseT, but the network distance between nodes, or span, is reduced. The encoding is 4B/5B.

The IEEE use the term 100BaseX to refer to both 100BaseT and 100BaseFx and the Media-Independent Interface (MII) allows a generic connector for transceivers to connect to 100BaseTx, 100BaseFx and 100BaseT4 LANs.

There are two classes of repeater, Class I and Class II. A Class I repeater has a repeater propagation delay value of 140 bit times, whilst a Class II repeater is 92 bit times. The Class I repeater (or Translational Repeater) can support different signalling such as 100BaseTx and 100BaseT4. The Class II repeater (or Transparent Repeater) can only support one type of physical signalling.

In one Collision Domain you are only allowed one Class I repeater, but you are allowed two Class II repeaters.

100BaseT4

100BaseFx

100BaseFx uses two cores of fibre (multi-mode 50/125um, 60/125um or single-mode) and 1300nm wavelength optics. The connectors are SC, Straight Tip (ST) or Media Independent Connector (MIC). The 100BaseT MAC mates with the ANSI X3T9.5 FDDI Physical Medium Dependent (PMD) specification. At half-duplex you can have distances up to 412m, whereas Full-duplex will give 2km.

There is also a proposed 100BaseSx which uses 850nm wavelength optics giving 300m on multi-mode fibre.

1000BaseX

802.3z is the committee responsible for formalising the standard for Gigabit Ethernet. The 1000 refers to 1Gb/s data speed. This is a further extension of 10/100BaseT using CSMA/CD and running at up to 500m on multi-mode fibre (1000BaseSX, 'S' for Short Haul using short-wavelength laser over multi-mode fibre) and at least 25m on Category 5 cable (1000BaseT). Many cable manufacturers are enhancing their cable systems to 'enhanced Category 5' standards in order to allow Gigabit Ethernet to run at up to 100m on copper. The Category 6 standard has yet to be ratified, and is not likely to be due until the end of 2000. Currently, on normal 62.5/125um multimode fibre, Gigabit Ethernet (1000BaseSX), using 850nm wavelength, can run up to 220m. Using 1300nm wavelength, Gigabit Ethernet (1000BaseLX where the 'L' is for Long wavelength laser, or Long Haul) can run up to 550m on 62.5/125um multi-mode fibre. Using 50/125um multimode fibre Gigabit Ethernet can run up to 500m using 850nm wavelength and 550m using 1300nm wavelength. 1300nm electronics is more expensive and so this is currently an issue as many multimode fibre installations using 62.5/125um fibre and so 220m is often the limit for the backbone when it should be 500m to satisfy ISO 11801 and EIA/TIA 568A.

1000BaseLX ('L' for Long Haul) runs on Single-mode fibre up to 5km using 1310nm wavelength.

Reproduced with kind permission - Rhys Haden

Please visit Rhys Haden's excellent web site for more information.

Rhys Haden's Technical Resource Web Site

Copyright © Rhys Haden 1998

 

10BASE-T	10 Mbps over two pair Category 3 cabling
10BASE-F	10 Mbps over multimode fiber optic cabling
10BASE-FL	10 Mbps over 850 nm multimode fiber cabling
10BASE-2	10 Mbps over RG-58 coaxial cable
100BASE-T2	100 Mbps over two pairs Category 3 cabling
100BASE-T4	100 Mbps over four pairs of Category 3, 4, or 5 UTP cabling
100BASE-TX	100 Mbps (Fast Ethernet) over two pairs of Category 5 UTP or STP cabling
100BASE-FX	100 Mbps over a two-fiber multimode system at 850 nm
	For Gigabit Ethernet transmission:
1000BASE-CX	Gigabit Ethernet over specially shielded balanced copper jumper cable assemblies
1000BASE-T	Gigabit Ethernet over 4 pair, TSB-95 compliant, twisted pair, Category 5e recommended, 100 meters
1000BASE-LX	Gigabit Ethernet over two fibers at 1300 nm -- 550 meters for both 62.5/125 and 50/125 micron multimode fiber cabling; also on singlemode fiber (long wavelength)
1000BASE-SX	Gigabit Ethernet over two fibers at 850 nm -- 220 meters if 62.5/125 micron multimode fiber; 550 meters if 50/125 micron multimode fiber (short wavelength)