Chapter 9 Hardware Address & Frame Type Identification Hardware address of frame Addressing schemes Ethernet Frame header format

Hardware address physical address that is unique to each node (station, computer, network equipment) Each frame transmitted on network contains a source address field and a destination address field Physical address is the unique address burned into each NIC card

Hardware addressing schemes Static Addressing – universally unique physical address already assigned by hardware manufacturer (most common) Configurable addressing – physical address on EPROM can be set by user Dynamic addressing – at boot up, computer generates and broadcasts a potentially unused physical address. Hardware manufacturers need not coordinate in assigning unique range of address

Frame Headers & Frame Format Each packet consists of a frame header followed by frame data (fig 9.2)(fig 9.2) Format of the headers differ for different network technologies (eg. Ethernet or Token Ring).

Ethernet version 2(DIX) frame format Ethernet version 2(DIX) frame format Header (fig 9.3)(fig 9.3) – Preceded by a 64-bit (8 byte) preamble containing alternating 1 & 0’s for synchronization – 6 byte destination address field – 6 byte source address field – 2 byte Ethernet frame type (eg. 0800x => IP). Eg. 0800xIP version xIPX 809BxAppletalk 806xARP 80D5xIBM SNA Payload – bytes data – Followed by 4 byte CRC

Unicast Frame sender sends a packet destined for a single network node by using the unique hardware address of destination node network interface card on each machine looks at the destination field of every packet. If the destination address in the frame matches the computer’s physical address, the frame is sent to the operating system of the computer; otherwise the frame is discarded

Broadcast Frame sender sends a packet destined for all network nodes by using a reserved broadcast address such as FF:FF:FF:FF:FF:FF in Ethernet frame network interface card on each machine looks at the destination field of every packet. If the destination address in the frame is the broadcast address or matches the computer’s physical address, the frame is sent to the operating system of the computer; otherwise the frame is discarded

Network Analyzer Sniffer / protocol analyzer dedicated computer used to analyze network activity by reading every packet and delivering it to the analyzer software. NIC is put in promiscuous mode Snoop, ethereal, Etherpeek