Ethernet, switches and MAC addresses: the LAN explained

In Year 3, in the Computer Science and Telecommunications track of the Italian technical institutes, the subject Systems and Networks (Sistemi e reti) starts from computer architecture: the Von Neumann model, the CPU and the machine cycle, memories, assembly or Arduino. This part usually fills September and October. Then come signals, protocols, LANs and WANs, Ethernet and the lab with Packet Tracer: this happens between November and December, and the test falls between December and January, that is 8-12 weeks from today, 5 October. If right now you are still on the CPU, that is normal. If you want to look ahead or revise the architecture, there is the post on Von Neumann and the CPU.

Here I talk only about the local network and layer 2. For the general map of the layers there is the post on ISO/OSI and TCP/IP, while IP addresses and subnets (layer 3) are in the post on Year 4 subnetting. Here we stop before that: how two computers connected to the same switch talk to each other.

What a LAN is and why today it is a star

A LAN (Local Area Network) is a network confined to a small space: a classroom, a lab, an office, a home. The shape of the connections is called the topology.

• Bus: a single shared cable that everyone plugs into. Cheap, but if the cable breaks everything goes down, and everyone fights for the same medium.
• Ring: each node is connected to the next, in a circle. Historically tied to other technologies (Token Ring).
• Star: each device has its own cable to a central point. Today it is the standard choice.

With the star, if one cable fails only that PC is disconnected; adding a device does not disturb the others. The centre of the star today is a switch, but it used to be a hub: the difference is the heart of this post.

The media: twisted pair and fibre

The cable you see in the lab is a UTP (Unshielded Twisted Pair): four pairs of twisted wires, which reduce interference. It ends in an RJ45 connector. The categories (Cat5e, Cat6 and the like) basically indicate the quality of the cable: the higher the category, the higher the speed and frequency the cable can handle. Optical fibre transmits pulses of light instead of electrical signals: it is unaffected by electromagnetic interference and covers longer distances, which is why it is used between buildings or for backbones.

The MAC address

Every network card has a MAC address (Media Access Control), designed to be unique. It is 48 bits long, that is 6 bytes, and is written in hexadecimal, one byte at a time separated by colons (or hyphens). For example:

00:1A:2B:3C:4D:5E

Each hexadecimal digit is worth 4 bits, so 12 digits make 48 bits. If hexadecimal bothers you, the post on two’s complement and floating-point numbers revises the basics of binary and hexadecimal.

The address divides into two halves:

• the first 3 bytes are the OUI (Organizationally Unique Identifier), assigned to the manufacturer;
• the last 3 bytes are chosen by the manufacturer itself to tell individual cards apart.

The MAC is a physical address, tied to the card. The IP address is logical: it depends on the network you are in and can change. The MAC is used to deliver the frame within the same local network; the IP is used to get the packet across different networks. There is also a special address, FF:FF:FF:FF:FF:FF, the broadcast address: it means “all the devices on this LAN”.

The Ethernet frame

At layer 2 the data travels in units called frames. We care about the structure, at a descriptive level:

The useful detail to remember is that the frame contains MAC addresses, not IP. The switch works by looking at the MAC addresses in the frame.

Hub and switch

The hub is a layer 1 device: it repeats every signal it receives on all the other ports, without understanding anything of what it contains. So all the devices connected to a hub share the same collision domain: if two transmit together, the signals collide.

The switch is a layer 2 device: it reads the destination MAC and sends the frame only on the right port. Each port of the switch is a separate collision domain. There remains a single broadcast domain: a broadcast frame is forwarded on all ports (unless VLANs are used, discussed in Year 5).

How does the switch know which MAC is on which port? It has a MAC table and builds it by itself, through learning:

1. when a frame arrives, the switch reads the source MAC and associates it with the port it came in on (it notes it in the table);
2. then it looks up the destination MAC in the table: if it finds it, it forwards the frame only on that port; if it does not find it, it does flooding, that is, it sends it out on all ports except the one it arrived on.

At the start the table is empty, so the first frames are flooded. As devices talk, the switch learns and forwarding becomes targeted. A device that never transmits is never learned. The hub, on the contrary, learns nothing: it has no tables.

CSMA/CD in a few lines

In the case of a shared medium (bus, hub) the problem is: how to prevent two stations from talking together? Ethernet uses CSMA/CD (Carrier Sense Multiple Access with Collision Detection):

1. before transmitting, the station listens to the channel (carrier sense);
2. if it is free, it transmits; if it is busy, it waits;
3. while transmitting it keeps listening: if it detects a collision, it stops;
4. it sends a short jam signal, so everyone knows there has been a collision;
5. it waits a random time, different for each station;
6. it tries again.

Today, with switches and full-duplex links (each pair of wires serves only one direction, so you transmit and receive at the same time) collisions no longer exist on the cable, and CSMA/CD is no longer used. But it is a test classic, because it explains why networks with hubs degraded as devices were added.

ARP: from IP to MAC

A PC knows the destination IP (for example because you typed it in the ping), but to build the frame it needs the MAC. It asks for it with the ARP protocol (Address Resolution Protocol):

1. the PC sends an ARP request in broadcast (destination MAC FF:FF:FF:FF:FF:FF): “who has this IP? Tell me your MAC”;
2. the device with that IP replies with an ARP reply, in unicast, giving its own MAC;
3. the PC saves the IP-MAC pair in the ARP table (the ARP cache), so as not to ask again for every packet.

If the recipient is outside the LAN, the PC does not look for the MAC of that host: it looks for the MAC of the gateway (the router), to which it delivers the frame.

How to study with Cisco Packet Tracer

In the lab you will use Cisco Packet Tracer, a network simulator. What you should be able to do, for a basic exercise:

• create a network with two PCs and a switch, connect them with the right cables, assign IPs to the hosts;
• check connectivity with ping from one PC to the other;
• read the PC’s ARP table with arp -a;
• on the switch, read the MAC table with show mac address-table;
• repeat the ping and observe how the tables change: before the first ping the switch’s MAC table usually does not contain the hosts, afterwards it does.

Packet Tracer also has a simulation mode, in which you can watch individual frames move: it is the best way to see flooding and targeted forwarding with your own eyes.

Typical mistakes

• Confusing MAC and IP. The MAC changes with the card, the IP with the network. In a LAN frame there is the MAC; the IP sits inside the data field.
• Thinking the switch looks at the IP. The switch (layer 2) looks only at MAC addresses. The one that reasons on IPs is the router, or a layer 3 switch.
• Saying that the hub “learns”. It has no tables: it repeats everything on all ports.
• Mixing up the domains. Switch: one collision domain per port, a single broadcast domain. Hub: a single collision domain.
• Forgetting that the source MAC is learned, not the destination one. It is the source that says “this MAC is on this port”.

Worked exercises

Exercise 1: reading a MAC

Given the MAC 00:1A:2B:3C:4D:5E: identify the OUI and the card part, write the first byte in binary and say how many possible MAC addresses exist.

OUI and card. The first 3 bytes are 00:1A:2B (OUI), the last 3 are 3C:4D:5E (part chosen by the manufacturer).

First byte in binary. 00 in hexadecimal is 0000 0000. For reference, 1A is 0001 1010 and 4D would be 0100 1101. In the first byte the least significant bit indicates whether the address is unicast (0) or multicast/broadcast (1); here it is 0, so it is an ordinary address of a single card. The second least significant bit, also 0, indicates an address assigned by the manufacturer (globally unique).

How many addresses. There are 48 bits, so:

possible addresses, about 281 thousand billion. For a single OUI there remain 24 free bits: $2^{24}=16777216$ cards.

Check: $2^{48}=2^{24}\cdot 2^{24}=16777216^2=281474976710656$.

Exercise 2: a switch’s MAC table

A switch has 4 ports (1, 2, 3, 4). PCs A (port 1), B (port 2), C (port 3), D (port 4) are connected. The MAC table is initially empty. These frames pass, in order:

1. A sends to B;
2. B sends to A;
3. C sends to A;
4. A sends to D.

For each frame: first the source is learned, then it is decided what to do with the destination.

Final table: A port 1, B port 2, C port 3. D does not appear: it has never transmitted, so the switch has had no way of learning it. At frame 1 the flooding also reached C and D, which however discarded the frame because the destination was not their MAC. At frame 4 the same: D receives it because it is the true destination, B and C ignore it. As soon as D replies to A, the switch will learn D on port 4.

Exercise 3: reading an ARP table

On the PC with IP 192.168.1.10 the command arp -a shows:

Internet Address  Physical Address      Type
192.168.1.1       00:1A:2B:3C:4D:5E     dynamic
192.168.1.20      08:00:27:AB:12:34     dynamic
192.168.1.35      B8:27:EB:9C:00:41     dynamic

Question a. What is the MAC of host 192.168.1.20? Answer: 08:00:27:AB:12:34. If the PC has to send a frame to that host, it puts that value as the destination MAC, without doing ARP.

Question b. Which IP does B8:27:EB:9C:00:41 correspond to? Answer: 192.168.1.35.

Question c. What happens if the PC has to talk to 192.168.1.50, which is not in the table? The PC does not have the MAC, so:

1. it sends an ARP request in broadcast (destination FF:FF:FF:FF:FF:FF) with the question “who has 192.168.1.50?”;
2. the switch, since it is a broadcast, forwards it on all ports;
3. the host that has that IP replies with an ARP reply in unicast, giving its own MAC;
4. the PC adds the row to the table and can build the frame.

If nobody replies (host switched off or non-existent), no row appears and the communication fails.

Note: the hosts in this table are on the same network 192.168.1.0, so they are resolved directly. For an IP outside the network the PC would resolve via ARP the address of the gateway, not that of the final destination.

Practice and simulation

For networking there is not yet a simulator on the site. For other tests you can look at the category of high school practice tests, while for the study method for the subject there is the Computer science page. The best way to prepare is to build the scenario of exercise 2 in Packet Tracer: set it up, do the pings in the order given and compare show mac address-table with what you predicted on paper.

If something doesn’t add up

Systems and Networks in Year 3 is a subject where you move from abstract concepts (layers, protocols) to a lab where everything has to really work, and the jump is not always obvious. If you get stuck on MAC, switches or ARP, write to me from the contact page: we do a free introductory call to work out what is not yet clear and how best to prepare for the test.