Chapter 3: Ethernet Basics

Ethernet is a networking technology defined by the IEEE 802.3 standard.

It includes rules for cables, speeds, frames, and communication methods.

First introduced in 1980, it has evolved with many updates (e.g., 802.3ae).

The frame structure (MAC addresses, data, FCS/CRC) stays consistent.

This allows backward compatibility between old and new devices.

Media (copper, fiber) and speeds can change, but the frame stays the same.

10 = Speed (10 Mbps)

BASE = Baseband (single-channel communication)

T = Twisted pair (UTP cable)

Other examples: 100BASE-T (100 Mbps), 1000BASE-T (1 Gbps).

Used thick coaxial cables (e.g., 10BASE5 = 10 Mbps, 500m max length).

Now uses UTP (e.g., 10BASE-T) or fiber optics.

Speeds increased from 10 Mbps → 100 Mbps → 1 Gbps → 10 Gbps+.

The frame structure doesn’t change, only the physical layer (cables, speed).

Media converters (e.g., fiber to copper) work because the frame is identical.

Specs on cable types, speeds, frame formats, and communication methods.

Because the frame format doesn’t change—only the speed or medium does.

The Ethernet frame is the standardized structure for data packets in Ethernet networks.

99% of internet traffic uses Ethernet frames.

Understanding frames is critical for network troubleshooting, exams (e.g., Network+), and packet analysis tools.

Preamble – Alternating 1s and 0s to signal the start of a frame.

Destination MAC Address (48-bit) – Where the frame is going.

Source MAC Address (48-bit) – Where the frame came from.

EtherType (2 bytes) – Identifies the protocol (e.g., IPv4, IPv6, ARP).

Data (Payload) – The actual information being sent (46–1500 bytes).

Pad (if needed) – Ensures the frame meets the minimum 64-byte size.

Frame Check Sequence (FCS) – A 32-bit CRC for error detection.

Minimum: 64 bytes (includes header + data; padding added if needed).

Maximum (Standard): 1518 bytes (1522 with VLAN tagging).

Jumbo Frames: Up to 9000 bytes (used in high-speed networks).

MTU (Maximum Transmission Unit) – The largest data chunk a frame can carry (usually 1500 bytes).

Preamble – Sync signal ("Here comes a frame!").

EtherType – Tells the protocol (e.g., 0x0800 = IPv4).

FCS (Frame Check Sequence) – Error-detection CRC.

MTU – Max data size per frame (default: 1500 bytes).

Troubleshooting – Corrupt frames trigger retransmissions (FCS errors).

Packet Analysis – Tools like Wireshark dissect frames.

Network Optimization – Jumbo frames reduce overhead in high-speed networks.

Crimper – Attaches RJ45 connectors to the cable.

RJ45 Connectors – The plastic plugs for Ethernet cables.

Cable Stripper/Scissors – Removes the outer insulation.

Cable Tester – Checks for continuity, pin alignment, and breaks.

UTP Cable (e.g., Cat5e, Cat6) – The actual twisted-pair wire.

T568B (Most Common)

Pin Order:

White/Orange

Orange

White/Green

Blue

White/Blue

Green

White/Brown

Brown

T568A

Same as T568B but swaps Green & Orange pairs (pins 1,2 ↔ 3,6).

Exam Note: Straight-through cables use the same standard on both ends (B/B). Crossover cables use T568A on one end, T568B on the other (for older device connections).

Strip the outer jacket (~1 inch).

Untwist and arrange wires in T568B order.

Trim wires evenly (~½ inch exposed).

Insert into RJ45 connector (ensure wires reach the end).

Crimp firmly (the connector should lock the wires in place).

Test with a cable tester (verify all pins connect correctly).

Straight-Through (T568B on both ends)

Used for: PC → Switch, Router → Switch, Modern devices (auto-MDI/X).

Crossover (T568A + T568B)

Historically for: PC → PC, Switch → Switch (now often obsolete due to auto-sensing ports).

Mismatched standards (e.g., T568A on one end, T568B on the other unintentionally).

Wires not reaching the end of the RJ45 connector (causes poor connection).

Too much/little jacket stripped (exposed wires or weak crimp).

Not testing the cable (leads to undetected faults).

Pro Tip: The correct name for "RJ45" is 8P8C, but everyone calls it RJ45.

Network+ expects knowledge of T568A/B, cable types, and use cases.

Troubleshooting skills (e.g., identifying crossover vs. straight-through errors).

Real-world applicability (even if pre-made cables are common, understanding wiring helps with repairs).

568B

White/Orange, Orange, White/Green, Blue, White/Blue, Green, White/Brown, Brown

Crimper

To verify continuity and ensure wires are correctly aligned.

A cable with the same wiring standard (e.g., 568B) on both ends.

A cable with 568A on one end and 568B on the other.

To allow direct communication between devices without a switch (e.g., PC to PC).

Auto-MDIX (automatic crossover detection in devices)

8 Position, 8 Contact (technical term for RJ45)

Operates at the Network Layer (Layer 3) of the OSI model.

Routes packets between networks using IP addresses (like a postal system uses ZIP codes).

Maintains a routing table to determine the best path for data.

Key for connecting LANs to WANs (e.g., home networks to the internet).

Acts as a security gate for incoming/outgoing traffic.

Enforces rules based on organizational security policies.

Can be hardware-based (physical appliance) or software-based (e.g., Windows Firewall).

Blocks malicious traffic while allowing legitimate communication.

IDS (Intrusion Detection System):

Monitors traffic for suspicious activity.

Alerts admins but does not block threats.

Like a "smoke detector."

IPS (Intrusion Prevention System):

Actively blocks malicious traffic.

Deployed at network perimeters or in next-gen firewalls.

Uses signatures (known threats) or anomaly detection (deviations from baseline).

Drawbacks: False positives (blocking safe traffic) and false negatives (missing threats).

Distributes incoming traffic across multiple servers to:

Improve performance (avoid overloading one server).

Provide fault tolerance (if one server fails).

Common in data centers, cloud services, and high-traffic websites.

Acts like a "traffic cop" for requests.

Acts as an intermediary between users and servers.

Benefits:

Enhances privacy (hides user IP addresses).

Improves performance (caches frequently accessed data).

Adds security (filters malicious requests).

Can be used for content filtering (e.g., blocking websites).

NAS (Network Attached Storage):

File-level storage (e.g., shared folders).

Connects directly to a LAN (like a standalone device).

Example: Home media servers.

SAN (Storage Area Network):

Block-level storage (appears as a local drive to servers).

Uses a dedicated high-speed network (Fibre Channel/iSCSI).

Used in enterprises for databases/VMs.

Router: Routes using IP addresses.

Firewall/IPS/IDS: Security filtering/monitoring.

Load Balancer: Distributes server traffic.

Proxy: Intermediary for privacy/performance.

NAS/SAN: File vs. block storage solutions.

Monitors network traffic and alerts if malicious activity is detected.

Actively blocks or prevents malicious traffic.

Safe traffic is incorrectly flagged as malicious.

Malicious traffic is mistakenly marked as safe.

Signature-based and anomaly-based detection.

Distributes incoming traffic across multiple servers to prevent overload and improve fault tolerance.

Data centers, content providers, and cloud platforms.

A mediator that handles user requests to other servers, enhancing privacy, security, and performance.

It hides the IP address of the requesting device.

A self-contained storage device connected to a LAN for centralized file access.

A specialized, high-speed network that provides block-level storage to servers.

SAN offers block-level access and is more complex, whereas NAS offers file-level access and is simpler.

Hub (Obsolete):

Operates at Layer 1 (Physical).

Repeats frames to all ports (like a multi-port repeater).

Shared bandwidth (e.g., 10 Mbps divided among all devices).

Collisions occur frequently (uses CSMA/CD to handle them).

Switch (Modern):

Operates at Layer 2 (Data Link).

Forwards frames selectively using MAC address tables.

Dedicated bandwidth per port (full speed for each connection).

Minimizes collisions (point-to-point connections).

A collision domain is a network segment where collisions can occur (e.g., two devices transmitting simultaneously).

Hubs create a single collision domain (all connected devices share bandwidth and risk collisions).

Switches eliminate collision domains (each port is its own collision domain).

CSMA/CD (Carrier Sense Multiple Access/Collision Detection) is used in hubs to manage collisions.

A broadcast domain includes all devices that receive broadcast traffic (e.g., ARP requests).

Switches forward broadcasts to all ports (like a hub), so all devices connected to a switch are in the same broadcast domain.

Routers separate broadcast domains (they do not forward broadcasts by default).

Broadcast MAC address: FF:FF:FF:FF:FF:FF.

Carrier Sense: Devices listen for traffic before transmitting.

Multiple Access: All devices share the same medium (hub).

Collision Detection: If two devices transmit simultaneously:

Detect the collision (voltage spike).

Send a jam signal.

Wait a random backoff time (using "electronic dice") before retrying.

Obsolete in switches (full-duplex connections prevent collisions).

Learns MAC addresses by examining the source MAC of incoming frames.

Maps each MAC to the port number where it’s connected.

Floods unknown frames (e.g., for new devices or broadcasts).

Aging timer: Removes stale entries (default: 300 seconds).

Performance:

Switches offer dedicated bandwidth per port (no shared collisions).

Security:

Hubs broadcast traffic to all ports (easy eavesdropping).

Switches isolate traffic (harder to snoop).

Scalability:

Hubs degrade with more devices; switches handle high traffic efficiently.

Eliminates collisions → Faster throughput.

Reduces latency (no CSMA/CD delays).

Improves security (no passive eavesdropping).

Plug-and-play upgrade (no configuration needed for basic operation).

A simple multiport repeater that broadcasts incoming signals to all ports without any intelligence.

No. Hubs do not learn or store MAC addresses.

A network segment where data packets can collide when being sent on a shared medium.

One. All devices connected to a hub share the same collision domain.

CSMA/CD (Carrier Sense Multiple Access with Collision Detection).

A device that forwards data intelligently based on MAC addresses and reduces collisions.

Only for certain traffic types, like ARP requests or unknown MAC addresses.

A MAC address table (also called a forwarding table or CAM table).

One per port. Each port on a switch is its own collision domain.

A logical area where all devices receive broadcast frames.

No. All devices connected to a hub or switch are in the same broadcast domain unless segmented by a router or VLAN.

FF:FF:FF:FF:FF:FF

Reduced collisions, full-duplex communication, better bandwidth efficiency, and MAC address learning.

For packet capturing/sniffing, though most people use a switch with a SPAN/monitor port instead.

Traditional Method: Use a crossover cable (T568A on one end, T568B on the other) to connect switch-to-switch.

Uplink Port (Older Switches):

A dedicated port with an MDI-X button to toggle between crossover/normal mode.

Allows use of a straight-through cable when enabled.

Modern Switches: Use auto-MDI-X (auto-sensing) ports that detect and adjust for cable type automatically (no crossover needed).

Definition: A loop created when switches are interconnected in a way that allows frames to circulate endlessly (e.g., Switch 1 → Switch 2 → Switch 3 → Switch 1).

Impact:

Causes broadcast storms (frames multiply until network is overwhelmed).

Crashes the network due to bandwidth saturation and MAC table corruption.

Example: Plugging multiple cables between switches without STP.

Purpose: STP blocks redundant paths to prevent loops while maintaining fault tolerance.

Process:

Elects a root bridge (central switch).

Sends BPDUs (Bridge Protocol Data Units) to detect loops.

Blocks redundant ports (places them in a "blocking" state).

Result: Only one active path exists between switches; backup paths activate if the primary fails.

Bridge Protocol Data Units (BPDUs): Special frames exchanged by switches running STP.

Functions:

Elect the root bridge (lowest Bridge ID wins).

Determine the shortest path to the root.

Block redundant paths to prevent loops.

Sent every 2 seconds to maintain topology stability.

Definition: A feature that automatically detects cable type (straight-through/crossover) and adjusts port settings.

Benefit: Eliminates the need for crossover cables when connecting switches or devices.

Modern Standard: Most switches and NICs support auto-MDI/X.

Crossover Cables: Needed for older switches without auto-MDI/X.

Switching Loops: Cause broadcast storms; prevented by STP.

STP Roles: Root bridge, designatedlocked ports.

BPDUs: Used for STP communication.

Uplink Ports: Legacy feature; modern switches use auto-MDI/X.

Use STP: Always enable STP (or its modern variant, RSTP/MSTP) to prevent loops.

Label Cables: Avoid accidental loops by documenting connections.

Avoid Redundant Cables: Unless using LAG (Link Aggregation) for redundancyandwidth.

Verify Auto-MDI/X: Most modern gear handles cable types automatically.

To expand the network and create point-to-point connections between switches.

It can increase the size of the broadcast domain and potentially create switching loops.

A crossover cable.

Straight-through: Same standard on both ends (e.g., T568B ↔ T568B).

Crossover: Different standards (e.g., T568A ↔ T568B) to cross transmit and receive pairs.

It internally performs the crossover function, allowing the use of a straight-through (patch) cable to connect switches.

When enabled, it configures the port for uplink (MDX mode), making crossover unnecessary.

Medium Dependent Interface Crossover.

Auto MDI-X, which automatically detects and configures the connection type.

A feature in modern switches that allows automatic configuration of transmit and receive pairs, so any straight-through cable works.

A network condition where multiple connections between switches form a loop, causing endless data circulation and a network crash.

Spanning Tree Protocol (STP).

Bridge Protocol Data Units — frames sent by switches in STP to elect a root bridge and block redundant paths.

To prevent switching loops by disabling redundant paths until needed.

The central switch elected by STP to manage path decisions and avoid loops.

No. Even with auto MDI-X, improper connections can still create switching loops and crash the network.