Data Encapsulation, Addressing, and Switching Techniques
Data Encapsulation Functions
The three primary functions of data encapsulation are:
- Frame Delimiting: Identifies a group of bits that make up a frame, ensuring synchronization between transmitting and receiving nodes.
- Addressing: Each Ethernet header added to the frame contains the physical address (MAC address) that enables a frame to be delivered to a destination node.
- Error Detection: Each Ethernet frame includes a trailer with a cyclic redundancy check (CRC) of the frame contents.
Multicast Address Function
A multicast address is used to address a group of nodes in the segment.
- The multicast MAC address is a special value that begins with
01-00-5Ein hexadecimal. - The remaining portion of the multicast MAC address is created by converting the lower 23 bits of the IP multicast group address into 6 hexadecimal characters.
How Switches Build MAC Address Tables
Switches dynamically build the CAM (Content Addressable Memory) by monitoring source MAC addresses. They learn by examining the source MAC address of the frames received on a port.
Destination MAC Address Selection
If the destination IPv4 host is within the local network, the frame will use the MAC address of that device as the destination MAC address. For packets destined for external networks, the MAC address of the router interface (gateway) will be used as the destination MAC address.
Forwarding Methods for Switching
Two forwarding methods for switching data between network ports are:
- Store-and-Forward: This method waits until the entire frame has arrived before forwarding it.
- Cut-Through: This method begins forwarding the frame as soon as the destination address is identified.
Variants of Cut-Through Switching
Two variants of cut-through switching are:
- Fast-Forward Switching: This method has the lowest latency and immediately forwards a packet after reading the destination address. It is a typical cut-through method.
- Fragment-Free Switching: This method stores the first 64 bytes of the frame before forwarding. This is because most network errors and collisions occur during the first 64 bytes.
Memory Buffering Methods
An Ethernet switch may use buffering to store frames before forwarding them. Two memory buffering methods are:
- Port-Based Memory: Frames are stored in queues linked to specific incoming and outgoing ports.
- Shared Memory: All frames are deposited into a common memory buffer, which all ports on the switch share.
Duplex Mismatch
Full-duplex: Both ends of the connection can send and receive simultaneously.
Half-duplex: Only one end of the connection can send at a time.
A common cause of performance issues on Ethernet links is when one port on the link operates at half-duplex and the other at full-duplex.
ARP Spoofing or ARP Poisoning
ARP spoofing is a technique used by an attacker to reply to an ARP request for an IPv4 address belonging to another device, such as the default gateway.
The attacker sends an ARP reply with its own MAC address. The receiver of the ARP reply will add the wrong MAC address to its ARP table and send these packets to the attacker.