📚 Overview - Analyst

Expert Sniffer

Created: 29.11.2020

This article is about some general stuff that happens on the physical layer.

CSMA/CD =

Carrier Sense - Who gets to talk? Wait for your turn
Multiple Access - When you are done, you can immediately send another request. Like, to ask. a doctor check your nose after throat examination you don’t need another appointment, just ask right away.
Collision Detection - NICs have a module that detect abnormal voltage (collision).

Domain - area in within which all devices hear or see everything (not necesarily respond).

Collision domain - area in which all devices hear or see collisions occuring. Hubs and are in the same collision domain while switches are not.

Broadcasr domain - area in which all devices hear or see broadcast traffic (hubs, switches break up broadcast domains; routers do) ❓

Four causes of trouble

Collisions (see below).
Signal reflection. Unterminated cable, imdence mismatch, too high band radius of the cable. Electrons are “bouncing back” when there is no resistor to absorb the voltage potential OR when there are several wires with different impedence.

Below is the depiction of a cable that does not contain a resistor at the end:

Below is the depiction of two cables with different impedence being connected:

Screenshot 2021-02-20 at 14.43.42

Expert Sniffer is the tool to detect runt and corrupted frames. Can of course also be examined with a hex editor.

very short frames (typically less than 16-32 bytes),
no preamble in the frame
all frames cut short at approximately the same offset

Electrical noise. Also, no preamble in the frame. Frames are cut off at random length. ❓
Hard malfunctions. The hardest to diagnose <= lots of evidence and forms. Generally, garbage:
1. 1’s and 0’s random “jabbering”. Most trnseivers detect garbage and have parameters of max time jabber “tolerance” set.
2. Gigantic frames (> 1500 bytes).

Early Collisions

Let’s imagine that two NICs (netword card of different PCs) want to talk to each other. The wire is idle at the moment. Both Bob 👨‍🎨 and Alice 🤸‍♀️ want to send something on the wire and ask the wire approximately the same moment:

Hey, wire, are you busy?

The wire is not busy and that’s why it replies I’m free as a bird to each one of them.

Screenshot 2021-02-20 at 11.19.07

Why, by the way, the wire replies with such a precise time? 9.6 ms? The sole reason for the 9.6 microsecond interframe gap is to allow the station that last transmitted to cycle its circuitry from transmit mode to receive mode. Without the interframe gap, it is possible that a station would miss a frame that was destined for it because it had not yet cycled back into receive mode. From firewall.cx.

Since both think that the wire is free (and so it actually is at the moment), both send some stream of bits (green ball).

Screenshot 2021-02-20 at 11.19.25

The balls are approaching each other…

Screenshot 2021-02-20 at 11.19.30

… and babam! 💥 When they meet, there appears an abnormal voltage (collision). This interrupted frame is called Runt.

Screenshot 2021-02-20 at 11.19.37

This abnormal voltage then propagates back to both Bob 👨‍🎨 and Alice 🤸‍♀️.

Screenshot 2021-02-20 at 11.19.48

Their NICs both understand that there was a collision and therefore their data was not sent. Both of them send 32 bit jam and let. TBEBA (Truncated Binary Exponential Backoff Algo) takes it from there to determine the best time when to retry. All this takes at max 2-3 ms usually.

This is a normal flow. But sometimes when the wire is longer that it should be or a malfunctioning adapter, for example, or there was some other reason (can’t think for any), late collision can happen (this is very bad). A collision can be detected only if NIC’s in transmit mode.

Late Collisions

For 10BASE5 thick Ethernet the recommended wire length is 500 meters. For 10BASE2 think Ethernet - 185 meters. A problem can happen if the wire is longer than that.

Say, the collision took place very close to Alice 🤸‍♀️ and very far from Bob 👨‍🎨.

Screenshot 2021-02-20 at 12.12.57

As usual, as soon as the collision takes place, an abnormal voltage propagetes in both directions: to Alice 🤸‍♀️ and Bob 👨‍🎨. Alice sends jam bits upon detecting this collision as it should have, but Bob 👨‍🎨 is no longer listening. When Bob’s NIC gets this signal, it doesn’t understand what is that and does not resend the frame. Such collisions are only fixed on the upper layers, which can take 10-100 times as much.

❗️ Full-duplex communication allows for the conversations in both directions simultaneously. Semi-duplex - only one direction at a time. The NIC switches between the two modes. The protocol used is now not seen on the network, since most of the connections are full-duplex.

Explanations

the speed of light 🌞 ~ 300 000 000 m/sec

the speed of electrons in copper ~ 2/3 ~ 200 000 000 m/sec

Ethernet operates on 10Mbps (10 000 000 bit/sec)

the speed of electrons / 10 Mbps = 20 m/bit => one bit occupies approximately 20 meters. One frame is at least 64 bytes (512 bits) in size. Therefore, the minimum size of the wire is 20 m/bit * 512 bit = 10240 m.

500 m/20 m/bit = is approximately 25 bits. We have a wire 500 m long. Suppose, a collision happended max close to Alice 🤸‍♀️, almoust 500 m far from Bob 👨‍🎨. At any given time (assuming, all of the wire is accupied with bits). So, it’s fair to say that the 500 meter wire is approximately 25 bits. So, as we have assumed, our collision happened max close to Alice 🤸‍♀️. The time the abnormal voltage propagates back to Bob 👨‍🎨, it will have sent another 25 bits already, which is 50 bits in total. So, Bob 👨‍🎨 would have sent 50 bits in total before he detects the collision. The collision is considered late, if 512 bits have already been sent by one or both of the parties.

Let’s do the reverse math: How long does the wire has to be to cause the late collision?

Since max amount of bits transfered before the collision is considered “late” is 512 bits:

500 m/20m/bits = 25 bits. X m / 20m/bits = 512 bits = > x = 512 * 20 m/b = 5000 m.

That hell too much. Why? Simple precautions?

The first reason is that it is possible to extend that length with up to 4 repeaters before the IEEE 802.3 spec is violated. This means that the signal may have to travel through as much as 2500 metres of cable to reach Station B, or 5000 metres of cable round trip.

The second reason is, yes, precautions. The specifications are twice as strict as needed, allowing ample room for errors 🤪.

Troubleshooting cheatsheet

For a COAXIAL Ethernet. This is taken from here.

Is a preamble (less than 8 bytes of AA or 55) visible at the very end of the frame?

Yes.

Make sure you haven’t exceeded the specifications of your cable (maximum cable length, maximum repeaters in between nodes, etc)

Use a “divide and conquer” method to isolate the troublemakers. Separate the network into halves using a bridge and see which side of the bridge the problems occur on. Now separate that half into halves, etc….

No - go on.

Are the corrupt frames very short, and consistently the same length?

Yes.

Signal reflection. First check for un-terminated cables. If the cable is terminated properly, your job becomes a lot harder. If new cable has been installed recently, impedance mismatch is probably the problem. Avoid this problem by buying all your cabling from the same lot (if possible) and buying cabling all at once and putting extra in storage rather than ordering as needed. Finally, check for cable deformation due to bending the cable or placing heavy objects on the cable.

A Time Domain Reflectometer can really save you some work when diagnosing this type of problem. This device can tell you, probably to the foot, how far down the wire the signal reflection is occurring.

No - go on.

Are the frames random in length, all cut off cleanly with no signs of bit streaming or other hardware malfunction?

Yes.

Your problem is probably electrical noise. Use the “divide and conquer” method outlined in bullet number 1 to determine where the noise is occurring and then use your intuition. I’ve seen problems as bizarre as a dentist’s X-ray machine being on the other side of the wall to the wiring closet and every time the dentist took an X-ray the network would go down!

No - go on.

If you’ve arrived at this point, your problem is probably hardware related. Use the “divide and conquer” method outlined in bullet 1.

Signal Encoding

It’s the format of voltage transmission. Defines how to encode bits as electrical signals. Some of them are differencial, some are not. Differential - when the bit’s representation depends on the previous bit. Differential encoding schemes are good in the presence of the noise. Detecting a voltage transition is easier than assuring voltage maintains at a certain level. Bipolar AMI and Pseudoternary - alterations in 1s provide extra sunc info for the receiver => long sequence can be distorted and clocks may drift, but 1s each tells the receiver when the transition occur and help resync. But the problem’s when lot’s of 0s follow.

For example, lets send this value using different encoding schemes: 0 0 1 1 0 1 0 1.

RZ

RZ stands for “return to zero”. No signal - 0, signal - 1.

With RZ a ‘0’ bit is represented by 0 volts whereas a ‘1’ data bit is represented by +V volts for half the cycle and 0 volts for the second half of the cycle. This means that the average DC voltage is reduced to 1/4V plus there is the added benefit of there always being a voltage change even if there are a series of ‘1’s. Unfortunately, the efficiency of bandwidth usage decreases if there are a series of ‘1’s since now a ‘1’ uses a whole cycle.

NPZ-L

NPZ-L means “non return to zero level”. When a 1 is transmitted, higher voltage is detected and when a lower voltage is detected (zero volts) - means 0 is being transimitted. With this signal encoding scheme it is difficult to distinguish a series of 1s or 0s due to clock synchronisation issues. Since 0 is 0 voltage and 1 is uses a higher voltage the average voltage is 1/2 volts => high power output.

In addition, the bandwidth is large i.e. from 0Hz to half the data rate because for every full signal wave, two bits of data can be transmitted (remember that with MPE the data rate equals the bit rate which is even more inefficient!) i.e. two bits of information are transmitted for every cycle (or hertz). ❓ After 50m of cable attenuation the signal amplitude may have been reduced to 100mV giving an induced noise tolerance of 100mV.