LAB - Identifying MAC and IP Address

Objectives of the lab

• 
  

  Gather PDU Information

  
  


• 
  

  Reflection Questions

  
  

Background

This lab is prepared for viewing PDUs. The devices are already configured. You will get PDU information using simulation mode and answer questions about the data you collect.

Gather PDU Information

Gather PDU information as a packet travels from 192.168.10.2 to 192.168.20.2

Click 172.16.31.2 > click desktop and open the Command Prompt.

Enter the ping 192.168.20.2 command in command prompt.

Switch to simulation mode you will see a PDU appears next to192.168.10.2.

Click the PDU and note the following information from the Outbound PDU Layer tab:

Destination MAC Address: 0060.47AD.C801

Source MAC Address: 000A.41E7.AD04

Source IP Address: 192.168.10.2

Destination IP Address: 192.168.20.2

Download topology here

 At Device: Computer Click Capture / Forward to move the PDU to the next device. Gather the same information from Step just like step gather at 192.168.20.2. Repeat this method until the PDU reaches to its target. Maintain a record of the PDU information in a table.

Repeat this procedure for all of the following:

1. Ping 192.168.20.3 from 192.168.10.3


2. 2.Ping 192.168.20.4 from 192.168.10.4


3. Ping 192.168.20.4 from 192.168.10.3


4. Ping 192.168.10.4 from 192.168.20.3

 Answer the following questions regarding the captured data:

1. Did the Hub lose any of the information given to it?


2. What does the Hub do with MAC addresses and IP addresses?


3. Did the wireless Access Point do anything with the information given to it?


4. Was any MAC or IP address lost during the wireless transfer?


5. What was the highest OSI layer that the Hub and Access Point used?


6. Did the Hub or Access Point ever replicate a PDU that was rejected with a red “X”?


7. When examining the PDU Details tab, which MAC address appeared first, the source or the destination?

Identifying MAC and IP Addresses

IP addresses are used to see the address of the original source and the final destination of the packet. The destination IP address may be on the same IP network as the source or may be on a remote network.

Destination on the Same Network

There are two types of addresses assigned to a device on an Ethernet LAN:

• Physical address– Physical address also called the MAC address which is Used for Ethernet NIC to Ethernet NIC communications on the same network.


• Logical address– Logical Address((the IP address)which is used to send the packet from the original source to the final destination.

We earlier learned that physical addresses are working in layer 2 of the OSI Model. These addresses have a different purpose. For example, these addresses are used to transport the data link frame with the encapsulated IP packet from one NIC to another NIC on the same network. If the destination IP address is on the same network, the destination MAC address will be that of the destination device.

Figure 4.7 shows the Ethernet MAC addresses and IP address for Host-A sending an IP packet to Host-C on the same network.

The Address for Layer 2 Ethernet frame:

• Destination MAC address– This is the MAC address of Host-C Ethernet NIC.


• Source MAC address– This is the MAC address of Host-A’s Ethernet NIC.

The Address for Layer 3 IP packet:

• Source IP address–This is the IP address of the source


• Dest IP address- This the IP address for the final destination of the packet

Auto-MDIX

In Ethernet networking, Twisted Pair that used a port must be connected accordingly that the Transmit pair on one end is connected to the Receive pair on the other end, and vice versa. For the correct duplex setting; it is important to have the correct cable type defined for each port. Connections between particular devices, for example; switch-to-switch, switch-to-host, switch-to-router, router-to-router devices and router-to-host; required the use of exact cable types (crossover or straight-through).

What is Auto-MDIX.?

Auto-MDIX is a function that every port on the switch will automatically detect the Ethernet cable type being used (straight-through or crossover) and adjust to make a link over that cable. Most switch devices now support the MDIX auto interface configuration command in the CLI to enable the automatic medium-dependent interface crossover (auto-MDIX) feature.

When this feature is enabled; the switch automatically detects the type of cable attached to the port and configures the interfaces accordingly. so, if this function is enabled we can use either a crossover or a straight-through cable for connections to a copper 10/100/1000 port on the switch, anyway of the type of device on the other end of the connection.Most of the new switches by default enable the auto-MDIX feature.

Duplex and Speed Settings on Switch

Duplex and Speed settings are the most basic settings for each port of a switch. It is possible that the duplex and bandwidth settings between the switch port and the connected devices no match, just like a computer or another switch. There are two types of duplex settings used for communications on an Ethernet network. Full-duplex and Half-duplex, that we already discuss an earlier chapter.

• 
  

  Full-duplex

  
  

  Both ends of the connection can send and receive simultaneously.

  
  


• 
  

  Half-duplex

  
  

  Only one end of the connection can send at a time.

  
  

Auto-negotiation

Most Ethernet Switches has a function called auto-negotiation. This function is also available in NICs. Auto-negotiation makes possible two devices to automatically exchange information about duplex and speed settings. This function help switch and connected device to choose highest performance mode. If both devices have a capability full-duplex it will set both devices on full-duplex along with their highest common bandwidth.

See Figure 4.5, where PC-1 is connected to switch port-1. Both Ethernet NIC  and port can operate in full-duplex or half-duplex, so auto-negotiation set both sides on full-duplex.

The speed of switch is 10/100/1000 Mb/s and PC-1 Speed is 10/100 Mb/s so 100 is the highest common speed for both switch and PC-1, therefore, auto-negotiation set speed for 100 Mb/s for both. Most Cisco switches and Ethernet NICs default to auto-negotiation for speed and duplex. Gigabit Ethernet ports only operate in full-duplex.

Duplex Mismatch

A duplex mismatch occurs when the two communicating Ethernet devices connected with duplex settings that are not the same, either because of manual settings or the auto-negotiation process. Duplex Mismatch down the performance of devices.

Why duplex-mismatch occur?

An example of a duplex mismatch is if one port on the link operates at half-duplex while the other port operates at full-duplex, as shown in Figure 4.6. Duplex mismatches occur when either the Ethernet device or the Ethernet switch is hard-coded to full-duplex and the other side is configured for auto-negotiation. This happens because the switch, when not given any auto-negotiation information, will default to half duplex. This occurs when one or both ports on a link are reset, and the auto-negotiation process does not result in both link partners having the same configuration.

It also can occur when users reconfigure one side of a link and forget to reconfigure the other. Both sides of a link should have auto-negotiation on, or both sides should have it off.

Memory Buffering on Switches

An Ethernet switch uses a buffering technique to store frames before forwarding to the destination. Buffering can also be used when the destination port is busy due to congestion. During congestion at the port, the switch stores the frame until it can be transmitted. The area of memory where the switch stores the data is called the memory buffer. There are two methods of memory buffering:-

• Port-based memory buffering


• Shared memory.

Port-based Memory Buffering

In port-based memory buffering, frames are stored in queues that are linked to specific incoming ports. Switches utilizing port buffered memory in this type of buffering. In port buffering switch provide each Ethernet port with a certain amount of high-speed memory to buffer frames until transmitted.  A disadvantage of port buffered memory is the dropping of frames when a port runs out of buffers. It is also possible for a single frame to delay the transmission of all the frames in memory because of a busy destination port. This delay occurs even if the other frames could be transmitted to open destination ports.

Shared Memory Buffering

Some of the earliest Cisco switches use a shared memory design for port buffering. Shared memory buffering deposits all frames into a common memory buffer that all the ports on the switch share. The amount of buffer memory required by a port is dynamically allocated. The frames in the buffer are dynamically connected to the destination port. This allows the packet to be received on one port and then transmitted on another port, without moving it to a different queue.

Frame Forwarding Methods on Cisco Switches

Cisco switches support different Switching(frame forwarding) Methods. Switching Methods are determined how a switch receives, processes, and forwards a Layer 2 Ethernet frame. Important Switching methods are following:-

• Store-and-forward switching


• Cut-through switching

Store-and-forward switching

In Store and Forward switching, Switch copies each complete incoming Ethernet frame into the switch memory. During the storage process, the switch analyzes the frame for information about its destination. Switch also computes trailer for  Cyclic Redundancy Check (CRC) for errors. If a Cyclic Redundancy Check (CRC) error is found. Then Ethernet frame is dropped and if there is no Cyclic Redundancy Check (CRC) error, the switch forwards the Ethernet frame to the destination device.

Store and Forward switching can cause a delay in switching since Cyclic Redundancy Check (CRC) is calculated for each Ethernet frame. CRC uses a mathematical formula, based on the number of bits (1s) in the frame, to determine whether the received frame has an error. After confirming the reliability of the frame, the frame is forwarded out to the right port, toward its destination. Discarding frames with errors reduces the amount of bandwidth consumed by corrupt data. Store-and-forward switching is required for Quality of Service (QoS)

Cut-Through Switching

In cut-through switching, the switch copies into its memory only the destination MAC address the frame before making a switching decision, to which port to forward the data. The destination MAC address is located in the first 6 bytes of the frame following the preamble. The switch looks up the destination MAC address in its switching table, determines the outgoing interface port, and forwards the frame onto its destination through the designated switch port. The switch does not perform any error checking on the frame. switch operating in cut-through switching mode reduces delay because the switch starts to forward the Ethernet frame as soon as it reads the destination MAC address. Problem-related with cut-through switching is that the switch may forward bad frames. Cut-through switching is the predominant switching method used on Cisco switches. There are two variants of cut-through switching:

Fast-forward switching

Fast-forward switching gives the lowest level of latency because switch immediately forwards a packet after reading the destination address. for the reason that fast-forward switching starts forwarding before the entire packet has been received, there may be times when packets are relayed with errors. This occurs infrequently, and the destination network adapter discards the faulty packet upon receipt. In fast-forward mode, latency is measured from the first bit received to the first bit transmitted. Fast-forward switching is the typical cut-through method of switching.

Fragment-free switching

Fragment-free switching is an advanced form of cut-through switching. The switches operating in cut-through switching read only up to the destination MAC address field in the Ethernet frame before making a switching decision. The switches operating in fragment-free switching read and store at least 64 bytes of the Ethernet frame before switching it to avoid forwarding Ethernet runt frames (Ethernet frames smaller than 64 bytes).  Fragment-free switching can be viewed as a compromise between store-and-forward switching and fast-forward switching. The reason fragment-free switching stores only the first 64 bytes of the frame is that most network errors and collisions occur during the first 64 bytes.Fragment-free switching tries to improve fast-forward switching by performing a small error check on the first 64 bytes of the frame.  Fragment-free switching is a compromise between the high latency and high integrity of store-and-forward switching; and the low latency and reduced integrity of fast-forward switching.

Some switches are configured to perform cut-through switching on a per-port basis until a user-defined error threshold is reached; and then they automatically change to store-and-forward. When the error rate falls below the threshold, the port automatically changes back to cut-through switching.

Switch Fundamentals - Learning MAC Address

An Ethernet switch is a Layer 2 (data link layer) device, therefore switch uses MAC addresses to make forwarding decisions. It is completely unaware of the protocol being carried in the data portion of the frame, such as an IPv4 packet. The switch makes its forwarding decisions based only on the Layer 2 Ethernet MAC addresses.

Not like an Ethernet hub that repeats bits out all ports except the incoming port, an Ethernet switch consults a MAC address table to make a forwarding decision for each frame. The MAC address table is sometimes referred to as a content addressable memory (CAM) table.

Learning MAC Address Table

The switch automatically builds the MAC address table by examining the source MAC address of the frames received on any port. The switch forwards frames by searching for a match between the destination MAC address in the frame and an entry in the MAC address table. The following process is performed on each Ethernet frame that enters a switch.

Learning the Source and destination MAC Addresses

Every frame that enters a switch it any port is checked for new information to learn. It does this by examining the frame’s source MAC address and port number where the frame entered the switch.

If the source MAC address does not exist, it is added to the table along with the incoming port number. See table in the movie, PC-1 is sending an Ethernet frame to PC-6. The switch adds the MAC address for PC-1 to the table against port-1. If the destination MAC address is on the table, it will forward the frame out the specified port. As you can see in the table there is no mac address entry so the switch will flood the packet to all ports except incoming port. All other will discard the packet and PC-6 will reply. When PC-6 Reply switch will add mac address of PC 6 which is on port-6.By this method, the switch will add all mac addresses against each port. If the destination MAC address is a broadcast or a multicast, the frame is also flooded out all ports except the incoming port.

If the source MAC address does exist, the switch updates the refresh timer for that entry. By default, most Ethernet switches keep an entry in the table for 5 minutes. If the source MAC address does exist in the table but on a different port, the switch treats this as a new entry. The entry is replaced using the same MAC address but with the more current port number.

ARP

ARP is the process that a source host uses to determine the destination MAC address. Although the destination MAC address can be a unicast, broadcast, or multicast address, the source MAC address must always be a unicast.

Every device with an IP address on a network also has an Ethernet MAC address. When a device sends an Ethernet frame, it contains these two addresses:

• Destination MAC address 


• Source MAC address 

To resolve the destination MAC address ARP provides two basic functions:

• Resolving IPv4 addresses to MAC addresses

• Maintain a table of mappings

ARP Functions

Resolving IPv4 Addresses to MAC Addresses

Data link layer of the OSI model encapsulates the incoming packet into in Ethernet frame. Encapsulation process refers to an ARP table in its memory to find the MAC address that mapped to the IPv4 address.ARP table is also called ARP cache. The ARP table is stored in the RAM. Each sending device search its ARP table for a destination IPv4 address and its and a related MAC address

• If the destination IPv4 address is on the same network as the source IPv4 address, the device will look the ARP table for the destination IPv4 address.

• If the destination IPv4 address is not on the same network to the source IPv4 address, the device will look the ARP table for the IPv4 address of the default gateway.

Each entry of the ARP table binds MAC address with an IPv4 address. The relationship between IPv4 and MAC address is called a map. By the help of a map, we can locate an IPv4 address in the table and find out the corresponding MAC address. The ARP table saves the mapping temporarily. If the device received a frame and its find that there is no entry for the corresponding MAC address, then the device sends an ARP request.

ARP request messages are encapsulated directly within an Ethernet frame. There is no IPv4 header. The ARP request message includes following:

• Target IPv4 address –The IPv4 address of the destination device.

• Target MAC address - Unknown MAC address and this will be empty in the ARP request message.

The ARP request is encapsulated in an Ethernet frame with the following header information:

• Destination MAC address – This is a broadcast address requiring all Ethernet NICs on the LAN to accept and process the ARP request.

• Source MAC address – This is the MAC address of the ARP request sender.

• Type - ARP messages have a type field of 0x806. This informs the receiving NIC that the data portion of the frame needs to be passed to the ARP process.

ARP requests are a broadcast process, so it's flooded out to all ports by the switch except the receiving port. The device on the LAN which IPv4 address matches the target IPv4 address in the ARP request will reply. All other devices will discard the ARP request packet.

If the destination IPv4 address is not on the same network as the source IPv4 address, the source device needs to send the frame to its default gateway. This is the interface of the router. The device will encapsulate that packet in a frame using the destination MAC address of the local router.

The default gateway IPv4 address is stored in the IPv4 configuration of the hosts. When a host creates a packet for a destination, it compares the destination IPv4 address and its own IPv4 address to determine if the two IP addresses are located on the same network. If the destination host is not on its same network, the source checks its ARP table for an entry with the IPv4 address of the default gateway. If there is not an entry, it uses the ARP process to determine a MAC address of the default gateway.

Removing Entries from an ARP Table

ARP cache saves the entries for a specified period of the time. The times different depending on the device’s operating system.

Commands may also be used to manually remove all or some of the entries in the ARP table. After an entry has been removed, the process for sending an ARP request and receiving an ARP reply must occur again to enter the map in the ARP table.

ARP Tables

On a Cisco router, the show ip arp command is used to display the ARP table.

On a Windows, the arp –a command is used to display the ARP table.

Multicast MAC Address

A multicast address is a logical identifier for a group of hosts in a computer network that is available to process datagrams or frames intended to be multicast for a designated network service. A multicast address can be used in data link layer ( layer 2) of the OSI Model. For  IP multicasting, the authorities reserved the multicast mac address range from 01-00-5E-00-00-00 to 01-00-5E-7F-FF-FF for Ethernet and Fiber Distributed Data Interface (FDDI) media access control (MAC) addresses. The multicast MAC address is a special value that begins with 01-00-5E in hexadecimal. The remaining portion of the multicast MAC address is created by converting the lower 23 bits of the IP multicast group address into 6 hexadecimal characters.

The range of IPv4 multicast addresses is 224.0.0.0 to 239.255.255.255. By the help of multicast addresses, a source device can send a packet to a group of devices that belong to a multicast group. These devices are assigned a multicast group IP address. The source will always be a unicast address.

Multicast addresses can be used in remote gaming, where many players are connected remotely but playing the same game. Another use of multicast addresses is in distance learning through video conferencing, where many students are connected to the same class.

Broadcast MAC Address and IP Address

What is broadcast

When a single sender transmits messages to many receivers at once, is called a broadcast. So the most common example of a broadcast is the television and public radio systems.  In computer networking,  A Broadcast means that the network sends one copy of a packet to each destination. The broadcast is used very frequently in the networking world. The terms broadcast IP address and broadcast MAC address is common in networking.

Broadcast IP and Broadcast MAC

A broadcast packet contains a destination IPv4 address that has all ones (1s) in the host portion (see 172.17.255.255) in IP Packet. This numbering in the address means that all hosts on that local network (broadcast domain) will receive the packet. Several network protocols, such as ARP and DHCP, use broadcasts. See the animation, where the source host sends an IPv4 broadcast packet to all hosts on its network. The IPv4 destination address is a broadcast address, 172.17.255.255. When the IPv4 broadcast packet is encapsulated in the Ethernet frame, the destination MAC address is the broadcast MAC address of FF-FF-FF-FF-FF-FF in hexadecimal which is 48 ones in binary.

Unicast MAC Address and IP Address

In Ethernet; Broadcast and multicast addresses always describe a group of recipients. on the other hand; Unicast is used to explain communication where data is sent from one point to another point. In this case, a packet is sent from a single source to a specified destination. All Ethernet and IP networks support this type of transmission.A unicast MAC address is the unique address used when a packet is sent from a single transmitting device to a single destination device.

In the example shown, a host-A the source of the packet with IPv4 address 172.17.0.1 sending a packet to host-C which is a destination with IPv4 unicast address 172.17.0.10. For sending a unicast packet from source to destination, a destination IP address must be in the IP packet header. A destination MAC address must also be present in the Ethernet frame header. The IP address and MAC address combine to deliver data to a specific destination host.

Note – If you think your friends would find this useful, Please share it with them I’d really appreciate it.

MAC Address Representations

Hardware and software manufacturers represent the Physical address or MAC address in different hexadecimal formats that are 12 digits (6 byte or 48 bits), as shown in the following:

• MM:MM:MM:SS:SS:SS

• MM-MM-MM-SS-SS-SS

• MMM.MMM.SSS.SSS

The leftmost 6 digits (24 bits) called an "OUI" is associated with the adapter manufacturer. Every manufacturer registers and obtains MAC OUI as assigned by the IEEE. the manufacturer often possesses many OUI numbers associated with their different products.

The rightmost digits of a MAC address represent an identification number for the particular device. Devices manufactured by the same vendor OUI, each is given their own unique 24-bit number.

Finding MAC Addresses on a computer

On a Windows host, open the command prompt and enter the command ipconfig /all as shown in figure 4.4.This command can be used to identify the MAC address of an Ethernet adapter. Notice that in result it display the Physical Address of the computer  00-21-70-B9-50-95. On a MAC or Linux host, the ifconfig command is used.

 

We often see various representations of MAC addresses which depend on devices and operating system. Cisco routers and switches use the form XXXX.XXXX.XXXX where X is a hexadecimal character.

MAC Address

An Ethernet MAC address is a worldwide unique identifier assigned to network devices. Sometimes it is referred to as hardware address or physical address. MAC address is a 48-bit binary value expressed as 12 hexadecimal digits. As we know that decimal is a base ten “(xxx)10” number system and Hexadecimal is a base sixteen “(xxx)16” number system. The base sixteen number system uses the numbers from 0 to 9 and the letters from A to F. Where A= 10, B=11, C=12, D=13, E=14, and F=15.

Ethernet Identity

In Ethernet LAN, each network device is connected to share media. Therefore all nodes would receive every frame transmitted over the shared media. To stop the too much overhead involved in the processing of every frame, MAC addresses were created to identify the actual source and destination. MAC addressing provides a method for device identification.

MAC Address Structure

Vendor Develop Ethernet Card and assign to it a unique address followed by IEEE standards. IEEE required registration of any organization with them that manufactures Ethernet Devices and NIC cards. After registration, IEEE assigns a 3-byte code termed Organizational Unique Identifier(OUI). MAC Addresses assigned to an Ethernet device must have a vendor OUI and a unique serial number assigned to them.

IEEE requires a vendor to follow two simple rules, as shown in the figure:

• All MAC addresses assigned to a NIC or other Ethernet device must use that vendor's assigned OUI as the first 3 bytes.

• All MAC addresses with the same OUI must be assigned a unique value in the last 3 bytes.

OUI	Vendor Assigned Unique serial
24 bits	24 bits
6 Hexadecimal digits	6 Hexadecimal digits
00.00.00	00.00.00
Vendor ID assigned by IEEE	Unique device ID

 

Note: Duplicate MAC addresses are passable to exist due to mistakes during manufacturing or in some virtual machine implementation methods. In either case, it will be necessary to modify the MAC address with a new NIC or in software.

The Ethernet Frame Structure and The Ethernet Frame Fields

The Ethernet Frame Structure

Early versions of Ethernet were comparatively slow. The latest versions of Ethernet operate at 10 Gigabits per second. This is the fastest version of Ethernet. At the data link layer, the frame structure is almost the same for all speeds of Ethernet. The Ethernet frame structure adds headers and trailers around the Layer 3 PDU to encapsulate the message being sent, as shown in Figure 4.3.  Ethernet II is the Ethernet frame format used in TCP/IP networks.

Ethernet minimum size is 64 bytes and maximum size is 1518 bytes. This includes all bytes from the Destination MAC Address field through the FCS (Frame Check Sequence)  field. The Preamble field is not included when describing the size of a frame.

Every frame which is less than 64 bytes in length is considered a “runt frame” or “collision fragment” and is automatically discarded by receiving stations. Frames with more than 1500 bytes of data are considered “jumbo” or “baby giant frames”. If the frame is less then or greater then above mention size, the receiving device drops the frame.

The Ethernet Frame Fields

The preamble This field has 8 bytes. Start Frame Delimiter (SFD), also called the start of frame( 1 Byte) and the Preamble field has (7 bytes). This field is used for synchronization between the sending and receiving nodes and devices. These first eight bytes of the frame are used to acquire the attention of the receiving nodes. These first few bytes tell the receivers to get ready to receive a new frame.

Destination MAC Address Field

Destination MAC Address Field has 6-byte, the identifier for the recipient. This address is used by Layer 2. The address in the frame is compared to the MAC address of the device. If there is a match, the device accepts the frame. Can be a unicast, multicast or broadcast address.

Source MAC Address Field

Source MAC Address, the MAC address of the outgoing network card. This 6-byte field identifies originating device. Must be a unicast address.

Ether Type Field

This field size is 2-byte. This field identifies the upper layer protocol encapsulated in the Ethernet frame. Common values are, in hexadecimal, 0x800 for IPv4, 0x86DD for IPv6 and 0x806 for ARP.

Data Field

This field is containing the original encapsulated data from a higher layer. This field size is 46 - 1500 bytes. All frames must be at least 64 bytes long. If a small packet is encapsulated, additional bits called a pad are used to increase the size of the frame to this minimum size.

FCS

The Frame Check Sequence (4 bytes) is used to detect errors in a frame. It uses a cyclic redundancy check (CRC). The sending device includes the results of a CRC in the FCS field of the frame. The receiving device receives the frame and generates a CRC to look for errors. If the calculations match, no error occurred. Calculations that do not match are an indication that the data has changed, therefore, the frame is dropped. A change in the data could be the result of a disruption of the electrical signals that represent the bits.