LAN and WAN Protocols

Ethernet (IEEE 802.3)

Ethernet is the most widely deployed LAN technology. It was developed jointly by Xerox, Intel, and DEC in 1975 and later standardized by the IEEE 802.3 committee.

MAC Addresses

The structure of a MAC address:

• First 24 bits (OUI, Organizationally Unique Identifier): the vendor code assigned by the IEEE to equipment manufacturers
• Last 24 bits: the device serial number assigned by the vendor

Special MAC addresses:

• Broadcast address: FF:FF:FF:FF:FF:FF, meaning all stations in the LAN
• Multicast address: the lowest bit of the first byte is 1, meaning a group of stations
• Unicast address: the lowest bit of the first byte is 0, meaning a single station

The Ethernet Frame (Ethernet II Format)

The fields are:

1. Preamble: 7 bytes of alternating 0 and 1 bits (10101010), used by the receiver to synchronize its clock
2. Start Frame Delimiter (SFD): 1 byte, 10101011, marking the start of the frame
3. Destination MAC address: 6 bytes, the physical address of the receiver
4. Source MAC address: 6 bytes, the physical address of the sender
5. Type/Length field: 2 bytes
   • a value ≥ 1536 (0x0600) indicates a type (for example 0x0800 for IPv4, 0x0806 for ARP, 0x86DD for IPv6)
   • a value ≤ 1500 indicates a length (the original 802.3 format)
6. Data field: 46 to 1500 bytes. Padding is required when the data is shorter than 46 bytes, because the minimum Ethernet frame length is 64 bytes (14 bytes of header + 46 bytes of data + 4 bytes of FCS)
7. FCS (Frame Check Sequence): 4 bytes, a CRC-32 check used for error detection

The Evolution of Ethernet

Modern Ethernet uses switches and twisted pair (or fiber) almost exclusively, runs in full-duplex mode, and no longer uses CSMA/CD.

Virtual LANs (VLAN)

A VLAN (Virtual LAN) logically divides a physical LAN into several independent broadcast domains through switch configuration.

• Purpose: isolate broadcast domains and improve network security and performance
• Implementation: insert a 4-byte VLAN tag (the 802.1Q tag) into the Ethernet frame, carrying a VLAN ID (12 bits, 0 to 4095)
• Trunk port: a port connecting two switches, carrying frames with VLAN tags
• Access port: a port connecting an end device, belonging to a single VLAN and carrying untagged frames

Wireless LANs (IEEE 802.11)

A wireless LAN (WLAN) uses radio waves as its transmission medium. The most common standards are the IEEE 802.11 family (marketed as Wi-Fi).

The Evolution of the 802.11 Standards

The 802.11 Frame

An 802.11 frame is more complex than an Ethernet frame and contains up to four address fields, because the wireless environment requires distinguishing the transmitter, the receiver, the source, and the destination:

• Address 1: the receiver address (RA, Receiver Address)
• Address 2: the transmitter address (TA, Transmitter Address)
• Address 3: the source address (SA) or the destination address (DA), depending on the frame type
• Address 4: used only in a Wireless Distribution System (WDS)

Operating Modes

1. Infrastructure mode: all stations communicate through an AP (Access Point), which connects to the wired network. This is the most common mode.
2. Ad Hoc mode: stations communicate directly with each other without an AP. Also called an IBSS (Independent BSS).

Wi-Fi Security

• WEP (Wired Equivalent Privacy): the earliest encryption standard, based on RC4. It has been broken and is not secure.
• WPA (Wi-Fi Protected Access): an improved version of WEP using TKIP encryption
• WPA2: the current mainstream standard, using AES encryption (CCMP), with strong security
• WPA3: the newest standard, further strengthening security and supporting 192-bit encryption

Wide Area Network Protocols

The PPP Protocol

PPP is a data link layer protocol that carries network layer data over point-to-point links. It is widely used for dial-up access, DSL, and leased lines.

The PPP Frame

• Flag field: 0x7E, the frame delimiter (the same as HDLC)
• Address field: 0xFF, the broadcast address (PPP is point-to-point, so it has no real meaning)
• Control field: 0x03, an unnumbered frame (UI)
• Protocol field: indicates the protocol type of the data field (for example 0x0021 = IPv4, 0xC021 = LCP, 0x8021 = IPCP)
• FCS: usually 2 bytes (it can also be negotiated as 4 bytes), a CRC check

The PPP Phases

Establishing and maintaining a PPP link goes through four phases:

1. Link establishment: LCP (Link Control Protocol) negotiates link parameters such as the maximum receive unit (MRU), the authentication protocol, and the compression protocol
2. Authentication (optional): PAP (Password Authentication Protocol) or CHAP (Challenge Handshake Authentication Protocol) performs the authentication
   • PAP: a two-way handshake that sends the password in clear text, so it is weak
   • CHAP: a three-way handshake that uses an MD5 hash and never transmits the password in clear text, so it is strong
3. Network layer protocol: NCP (Network Control Protocol) configures parameters for each network layer protocol. IPCP (IP Control Protocol), for example, assigns IP addresses.
4. Data transfer: network layer data is transferred normally
5. Link termination: LCP terminates the link

The HDLC Protocol

HDLC is a bit-oriented data link layer protocol standardized by the ISO, and it is the basis for many other link layer protocols such as PPP, LAPB, and LAPD.

The HDLC Frame

• Flag field: 0x7E (01111110), with bit stuffing guaranteeing that the pattern never appears in the data
• Address field: identifies the secondary station (in multipoint connections); usually 0xFF in point-to-point links
• Control field: identifies the frame type and the sequence numbers
• FCS: 2 or 4 bytes, a CRC check

HDLC Frame Types

According to the format of the control field, HDLC frames fall into three categories:

1. Information frames (I-frame, Information): the first bit of the control field is 0

   • carry user data
   • contain the send sequence number N(S) and the receive sequence number N(R)
   • can piggyback an acknowledgment (N(R) indicates the sequence number of the next frame expected)

2. Supervisory frames (S-frame): the first two bits of the control field are 10

   • carry no data and are used for flow control and error control
   • four types: RR (receive ready, ACK), RNR (receive not ready), REJ (reject, GBN), SREJ (selective reject, SR)

3. Unnumbered frames (U-frame): the first two bits of the control field are 11

   • contain no sequence numbers and are used for link management
   • such as SABM (set asynchronous balanced mode), UA (unnumbered acknowledgment), and DISC (disconnect)

HDLC Operating Modes

• Normal Response Mode (NRM): a master/slave mode in which a secondary station may transmit only after being polled by the primary
• Asynchronous Response Mode (ARM): a secondary station may transmit on its own initiative, but the primary still manages the link
• Asynchronous Balanced Mode (ABM): a peer mode in which the two stations have equal standing and either may initiate a transmission. PPP uses a mode similar to ABM.

Data Link Layer Devices

Bridge

• Operates at the data link layer and forwards frames based on MAC addresses
• Usually has only 2 ports, used to connect two LAN segments
• Learns the MAC address table automatically and isolates collision domains
• Uses store-and-forward, so it forwards more slowly

Switch

• Operates at the data link layer (a layer 2 switch) and is essentially a multi-port bridge
• Forwards frames based on MAC addresses, and each port is an independent collision domain
• Supports both store-and-forward and cut-through forwarding
• Supports advanced features such as VLANs, QoS, and port aggregation
• Is the core device of a modern LAN

Worked Examples

Example 1: Ethernet Frame Padding

The data field of an Ethernet frame is only 20 bytes. How many bytes of padding are needed, and what is the total length of the frame?

Example 2: Analyzing the PPP Protocol

During the establishment of a PPP link, what is LCP responsible for and what is NCP responsible for? If a PPP connection carries only IPv4 data, which protocols are involved?

Example 3: MAC Addresses and Broadcast

The destination MAC address of an Ethernet frame is FF:FF:FF:FF:FF:FF. What kind of address is this, and which stations receive the frame?

---

Exercises

Exercise 1

Compare the PPP and HDLC protocols.

Exercise 2

What are the main differences between an Ethernet switch and a hub, and why did the switch replace the hub?

---

Glossary