Frame Operations

Frame Composition
Figure 4.1 illustrates the general frame composition of Ethernet and IEEE
802.3 frames. You will note that they differ slightly. An Ethernet frame contains
an eight-byte preamble, while the IEEE 802.3 frame contains a seven-byte
preamble followed by a one-byte start-of-frame delimiter field. A second difference
between the composition of Ethernet and IEEE 802.3 frames concerns
the two-byte Ethernet type field. That field is used by Ethernet to specify
the protocol carried in the frame, enabling several protocols to be carried
independently of one another. Under the IEEE 802.3 frame format, the type
field was replaced by a two-byte length field, which specifies the number of
bytes that follow that field as data.
The differences between Ethernet and IEEE 802.3 frames, while minor, make
the two incompatible with one another. This means that your network must
contain either all Ethernet-compatible NICs or all IEEE 802.3–compatible
NICs. Fortunately, the fact that the IEEE 802.3 frame format represents a
standard means that almost all vendors now market 802.3-compliant hardware
and software. Although a few vendors continue to manufacture Ethernet or
dual functioning Ethernet/IEEE 802.3 hardware, such products are primarily
used to provide organizations with the ability to expand previously developed
networks without requiring the wholesale replacement of NICs. Although the
IEEE 802.3 frame does not directly support a type field within the frame, as we
will note in Section 4 in this chapter, the IEEE defined a special type of frame
to obtain compatibility with Ethernet LANs. That frame is referred to as an
Ethernet Subnetwork Access Protocol (Ethernet-SNAP) frame, which enables
a type subfield to be included in the data field. While the IEEE 802.3 standard
has essentially replaced Ethernet, because of their similarities and the fact
that 802.3 was based upon Ethernet, we will consider both to be Ethernet.
Now that we have an overview of the structure of Ethernet and 802.3 frames,
let’s probe more deeply and examine the composition of each frame field. We
will take advantage of the similarity between Ethernet and IEEE 802.3 frames
to examine the fields of each frame on a composite basis, noting the differences
between the two when appropriate.
Preamble Field
The preamble field consists of eight (Ethernet) or seven (IEEE 802.3) bytes of
alternating 1 and 0 bits. The purpose of this field is to announce the frame
and to enable all receivers on the network to synchronize themselves to the
incoming frame.
Start-of-Frame Delimiter Field
This field is applicable only to the IEEE 802.3 standard and can be viewed as
a continuation of the preamble. In fact, the composition of this field continues
in the same manner as the format of the preamble, with alternating 1 and
0 bits used for the first six bit positions of this one-byte field. The last two
bit positions of this field are 11—this breaks the synchronization pattern and
alerts the receiver that frame data follows.
Both the preamble field and the start-of-frame delimiter field are removed
by the controller when it places a received frame in its buffer. Similarly, when
a controller transmits a frame, it prefixes the frame with those two fields (if it
is transmitting an IEEE 802.3 frame) or a preamble field (if it is transmitting a
true Ethernet frame).
Destination Address Field
The destination address identifies the recipient of the frame. Although this
may appear to be a simple field, in reality its length can vary between IEEE
802.3 and Ethernet frames. In addition, each field can consist of two or
more subfields, whose settings govern such network operations as the type of
addressing used on the LAN, and whether the frame is addressed to a specific
station or more than one station. To obtain an appreciation for the use of this
field, let’s examine how this field is used under the IEEE 802.3 standard as
one of the two field formats applicable to Ethernet.
Figure 4.2 illustrates the composition of the source and destination address
fields. As indicated, the two-byte source and destination address fields are
applicable only to IEEE 802.3 networks, while the six-byte source and destination
address fields are applicable to both Ethernet and IEEE 802.3 networks.
A user can select either a two- or six-byte destination address field; however,
with IEEE 802.3 equipment, all stations on the LAN must use the same
addressing structure. Today, almost all 802.3 networks use six-byte addressing,
because the inclusion of a two-byte field option was designed primarily
to accommodate early LANs that use 16-bit address fields.
Both destination and source addresses are normally displayed by network
monitors in hexadecimal, with the first three bytes separated from the last
three by a colon (:) when six-byte addressing is used. For example, the source
address 02608C876543 would be displayed as 02608C:876543. As we will
shortly note, the first three bytes identify the manufacturer of the adapter
card, while the following three bytes identify a specific adapter manufactured
by the vendor identified by the first three bytes or six hex digits.
I/G Subfield
The one-bit I/G subfield is set to a 0 to indicate that the frame is destined to
an individual station, or 1 to indicate that the frame is addressed to more than
one station—a group address. One special example of a group address is the
assignment of all 1s to the address field. Hex ‘‘FFFFFFFFFFFF’’ is recognized
as a broadcast address, and each station on the network will receive and
accept frames with that destination address.
An example of the use of a broadcast destination address is the service
advertising packet (SAP) transmitted every 60 seconds by NetWare servers.
The SAP is used to inform other servers and workstations on the network of
the presence of that server. Because the SAP uses a destination address of
FF-FF-FF-FF-FF-FF, it is recognized by every node on the network.
When a destination address specifies a single station, the address is referred
to as a unicast address. A group address that defines multiple stations is
known as a multicast address, while a group address that specifies all stations
on the network is, as previously mentioned, referred to as a broadcast address.
U/L Subfield
The U/L subfield is applicable only to the six-byte destination address field.
The setting of this field’s bit position indicates whether the destination address
is an address that was assigned by the IEEE (universally administered) or
assigned by the organization via software (locally administered).
Universal versus Locally Administered Addressing
Each Ethernet NIC contains a unique address burned into its read-onlymemory
(ROM) at the time of manufacture. To ensure that this universally administered
address is not duplicated, the IEEE assigns blocks of addresses to each
manufacturer. These addresses normally include a three-byte prefix, which
identifies the manufacturer and is assigned by the IEEE, and a three-byte
suffix, which is assigned by the adapter manufacturer to its NIC. For example,
the prefix 02608C identifies an NIC manufactured by 3Com, while a prefix of
hex 08002 identifies an NIC manufactured by Digital Equipment Company,
which was acquired by compaq computer.
Although the use of universally administered addressing eliminates the
potential for duplicate network addresses, it does not provide the flexibility
obtainable from locally administered addressing. For example, under locally
administered addressing, you can configure mainframe software to work with
a predefined group of addresses via a gateway PC. Then, as you add new
stations to your LAN, you simply use your installation program to assign a
locally administered address to the NIC instead of using its universally administered
address. As long as your mainframe computer has a pool of locally
administered addresses that includes your recent assignment, you do not have
to modify your mainframe communications software configuration. Because
the modification of mainframe communications software typically requires
recompiling and reloading, the attached network must become inoperative for
a short period of time. Because a large mainframe may service hundreds to
thousands of users, such changes are normally performed late in the evening or
on a weekend. Thus, the changes required for locally administered addressing
are more responsive to users accessing certain types of mainframe computers
than those required for universally administered addressing.
Source Address Field
The source address field identifies the station that transmitted the frame. Like
the destination address field, the source address can be either two or six bytes
in length.
The two-byte source address is supported only under the IEEE 802.3 standard
and requires the use of a two-byte destination address; all stations on
the network must use two-byte addressing fields. The six-byte source address
field is supported by both Ethernet and the IEEE 802.3 standard. When a
six-byte address is used, the first three bytes represent the address assigned
by the IEEE to the manufacturer for incorporation into each NIC’s ROM. The
vendor then normally assigns the last three bytes for each of its NICs.
Table 4.1 lists the NIC identifiers for 85 Ethernet card manufacturers.
Note that many organizations including Cisco Systems, 3Com, IBM, MIPS,
Ungermann-Bass, and Data General were assigned two or more blocks of
addresses by the IEEE. Also note that organizations listed in Table 4.1 range
in scope from well-known communications and computer manufacturers to
universities and even a commercial firm probably best known for its watch
commercials. The entries in Table 4.1 represent a portion of three-byte identifiers
assigned by the IEEE over the past decade and do not include identifiers
currently assigned to all vendors. For a comprehensive list of currently
assigned three-byte identifiers, readers should contact the IEEE. You can
contact the IEEE at:
IEEE Standards Department
445 Hoes Lane
P.O. Box 1331
Piscataway, NJ 08855
Telephone: +1 (732) 562-3813
Fax: +1 (732) 562-1571
Many software- and hardware-based network analyzers include the capability
to identify each station on a LAN, count the number of frames transmitted
by the station and destined to the station, as well as identify the manufacturer
of the NIC used in the station. Concerning the latter capability, this is
accomplished by the network analyzer containing a table of three-byte identifiers
assigned by the IEEE to each NIC manufacturer, along with the name of
the manufacturer. Then the analyzer compares the three-byte identifier read
from frames flowing on the network and compares each identifier with the
identifiers stored in its identifier table. By providing information concerning
network statistics, network errors, and the vendor identifier for the NIC in
each station, you may be able to isolate problems faster or better consider
future decisions concerning the acquisition of additional NICs.
An example of the use of NIC manufacturer IDs can be obtained by examining
two monitoring screen displays of the Triticom EtherVision network
monitoring and analysis program. Figure 4.3 illustrates the monitoring screen
during the program’s autodiscovery process. During this process the program
reads the source address of each frame transmitted on the segment that the
computer executing the program is connected to. Although obscured by the
highlighted bar, the first three bytes of the adapter address first discovered
is 00-60-8C, which represents a block of addresses assigned by the IEEE to 3
Com Corporation. If you glance at the first column in Figure 4.3, you will note
that the second row, fourth row, ninth row, and a few additional rows also
have NIC addresses that commence with hex 00-60-8C. By pressing the F2 key
the program will display the manufacturer of each NIC encountered and for
which statistics are being accumulated. This is indicated in Figure 4.4, which
shows the first three bytes of each address replaced by the vendor assigned
to the appropriate manufacturer ID. Thus, rows 1, 4, 9, and a few other rows
commence with ‘‘3Com’’ to indicate the manufacturer of the NIC.
Organizations can request the assignment of a vendor code by contacting
the IEEE Registration Authority at the previously listed address for the IEEE
provided in this section. A full list of assigned vendor codes is obtainable by
FTP at ftp.ieee.org as the file ieee/info/info.stds.oui. Readers should note that
the list is limited to those companies that agreed to make their vendor code
assignment(s) public.
The Triticom EtherVision source address monitoring feature discovers
the hardware address of each NIC. At the time this screen was captured
16 stations were identified.
Type Field
The two-byte type field is applicable only to the Ethernet frame. This field
identifies the higher-level protocol contained in the data field. Thus, this field
tells the receiving device how to interpret the data field.
Under Ethernet, multiple protocols can exist on the LAN at the same time.
Xerox served as the custodian of Ethernet address ranges licensed to NIC
manufacturers and defined the protocols supported by the assignment of type
field values.
Table 4.2 lists 31 of the more common Ethernet type field assignments.
To illustrate the ability of Ethernet to transport multiple protocols, assume
a common LAN was used to connect stations to both UNIX and NetWare
servers. Frames with the hex value 0800 in the type field would identify the
IP protocol, while frames with the hex value 8137 in the type field would
identify the transport of IPX and SPX protocols. Thus, the placement of an
appropriate hex value in the Ethernet type field provides a mechanism to
support the transport of multiple protocols on the local area network.
Under the IEEE 802.3 standard, the type field was replaced by a length field,
which precludes compatibility between pure Ethernet and 802.3 frames.
Length Field
The two-byte length field, applicable to the IEEE 802.3 standard, defines the
number of bytes contained in the data field. Under both Ethernet and IEEE
802.3 standards, the minimum size frame must be 64 bytes in length from
preamble through FCS fields. This minimum size frame ensures that there
Based on the minimum frame length of 64 bytes and the possibility of using
two-byte addressing fields, this means that each data field must be a minimum
of 46 bytes in length. The only exception to the preceding involves Gigabit
Ethernet. At a 1000-Mbps operating rate the original 802.3 standard would
not provide a frame duration long enough to permit a 100-meter cable run
over copper media. This is because at a 1000-Mbps data rate there is a high
probability that a station could be in the middle of transmitting a frame before
it becomes aware of any collision that might have occurred at the other end
of the segment. Recognizing this problem resulted in the development of a
carrier extension, which extends the minimum Ethernet frame to 512 bytes.
The carrier extension is discussed in detail in Section 4.6 when we turn our
attention to the Gigabit Ethernet carrier extension.
For all versions of Ethernet except Gigabit Ethernet, if data being transported
is less than 46 bytes, the data field is padded to obtain 46 bytes. However, the
number of PAD characters is not included in the length field value. NICs that
support both Ethernet and IEEE 802.3 frame formats use the value in this field
to distinguish between the two frames. That is, because the maximum length
of the data field is 1,500 bytes, a value that exceeds hex 05DC indicates that
instead of a length field (IEEE 802.3), the field is a type field (Ethernet).
Data Field
As previously discussed, the data field must be a minimum of 46 bytes in
length to ensure that the frame is at least 64 bytes in length. This means that
the transmission of 1 byte of information must be carried within a 46-byte
data field; if the information to be placed in the field is less than 46 bytes, the
remainder of the field must be padded. Although some publications subdivide
the data field to include a PAD subfield, the latter actually represents optional
fill characters that are added to the information in the data field to ensure a
length of 46 bytes. The maximum length of the data field is 1500 bytes.
Frame Check Sequence Field
The frame check sequence field, applicable to both Ethernet and the IEEE
802.3 standard, provides a mechanism for error detection. Each transmitter
computes a cyclic redundancy check (CRC) that covers both address fields, the
type/length field, and the data field. The transmitter then places the computed
CRC in the four-byte FCS field.
The CRC treats the previously mentioned fields as one long binary number.
The n bits to be covered by the CRC are considered to represent the coefficients
of a polynomial M(X) of degree n − 1. Here, the first bit in the destination
address field corresponds to the Xn−1 term, while the last bit in the data field
corresponds to the X0 term. Next, M(X) is multiplied by X32, and the result of
that multiplication process is divided by the following polynomial:
G(X)=X32+X26+X23+X22+X16+X12+X11+X10+X8+X7+X5+X4+X2+X+1
Note that the term Xn represents the setting of a bit to a 1 in position n. Thus,
part of the generating polynomial X5 + X4 + X2 + X1 represents the binary
value 11011.
This division produces a quotient and remainder. The quotient is discarded,
and the remainder becomes the CRC value placed in the four-byte FCS field.
This 32-bit CRC reduces the probability of an undetected error to 1 bit in every
4.3 billion, or approximately 1 bit in 232 − 1 bits.
Once a frame reaches its destination, the receiver uses the same polynomial
to perform the same operation upon the received data. If the CRC computed
by the receiver matches the CRC in the FCS field, the frame is accepted.
Otherwise, the receiver discards the received frame, as it is considered to have
one or more bits in error. The receiver will also consider a received frame to
be invalid and discard it under two additional conditions. Those conditions
occur when the frame does not contain an integral number of bytes, or when
the length of the data field does not match the value contained in the length
field. The latter condition obviously is only applicable to the 802.3 standard,
because an Ethernet frame uses a type field instead of a length field.
Interframe Gap
Under the 10-Mbps versions of the CSMA/CD protocol a 9.6 microsecond
(μs) quiet time occurs between transmitted frames. This quiet time, which
is referred to as an interframe gap, permits clocking circuitry used within
repeaters and workstations and hub ports to be resynchronized to the known
local clock. Under Fast Ethernet the interframe gap is 0.96 ms, while under
Gigabit Ethernet the gap is reduced to 0.096 ms.
4.2 Media Access Control
In the first section in this chapter, we examined the frame format by which
data is transported on an Ethernet network. Under the IEEE 802 series of
10-Mbps operating standards, the data link layer of the OSI Reference Model
is subdivided into two sublayers—logical link control (LLC) and medium
access control (MAC). The frame formats examined in Section 4.1 represent
the manner in which LLC information is transported. Directly under the LLC
sublayer is the MAC sublayer. The MAC sublayer, which is the focus of this
section, is responsible for checking the channel and transmitting data if the
channel is idle, checking for the occurrence of a collision, and taking a series
of predefined steps if a collision is detected. Thus, this layer provides the
required logic to control the network.
Figure 4.5 illustrates the relationship between the physical and LLC layers
with respect to the MAC layer. The MAC layer is an interface between user
data and the physical placement and retrieval of data on the network. To better
understand the functions performed by the MAC layer, let us examine the
four major functions performed by that layer—transmitting data operations,
transmitting medium access management, receiving data operations, and
receiving medium access management. Each of those four functions can be
viewed as a functional area, because a group of activities is associated with
Medium access control. The medium access control (MAC) layer
can be considered an interface between user data and the physical placement
and retrieval of data on the network.
each area. Table 4.3 lists the four MAC functional areas and the activities
associated with each area. Although the transmission and reception of data
operations activities are self-explanatory, the transmission and reception of
media access management require some elaboration. Therefore, let’s focus our
attention on the activities associated with each of those functional areas.
Transmit Media Access Management
CSMA/CD can be described as a listen-before-acting access method. Thus,
the first function associated with transmit media access management is to
find out whether any data is already being transmitted on the network and, if
so, to defer transmission. During the listening process, each station attempts
to sense the carrier signal of another station, hence the prefix carrier sense
(CS) for this access method. Although broadband networks use RF modems
that generate a carrier signal, a baseband network has no carrier signal in
the conventional sense of a carrier as a periodic waveform altered to convey
information. Thus, a logical question you may have is how the MAC sublayer
on a baseband network can sense a carrier signal if there is no carrier. The
answer to this question lies in the use of a digital signaling method, known as
Manchester encoding on 10-Mbps Ethernet LANs, that a station can monitor
to note whether another station is transmitting. Although NRZI encoding is
used on broadband networks, the actual data is modulated after it is encoded.
Thus, the presence or absence of a carrier is directly indicated by the presence
or absence of a carrier signal on a broadband network.
is sufficient transmission time to enable Ethernet NICs to detect collisions
accurately, based on the maximum Ethernet cable length specified for a
network and the time required for a frame to propagate the length of the cable.