Important Note: Ethernet dalam istilah Computer Network (IEEE 802.3) adalah teknologi layer 2 (data link) untuk menghantarkan data dalam suatu Local Area Network (LAN) dengan membaca MAC Address (dalam bentuk frame), jadi bukan sebuah mesin, alat, atau kabel yang seperti kebanyakan orang bilang
Ethernet itu adalah sebuah protocol
Ethernet Frame Field (di dalam data Ethernet yang dikirim Switch…ada apa aja sih??)
warning: most of this article words are in english…wkwkwk
The Preamble (7 bytes) and Start Frame Delimiter (SFD) (1 byte) fields digunakan untuk sending dan receiving. 8 byte pertama dari frame Ethernet digunakan untuk memberitahu lawan “bicara” bahwa mereka siap untuk menerima atau mengirim frame.
The Destination MAC Address field (6 bytes) is the identifier for the intended recipient. Seperti yang kita tahu bahwa alamat ini digunakan layer 2 (data link) untuk membantu devices menentukan apakah sebuah frame yang ditujukan kepada mereka. The address in the frame is compared to the MAC address in the device. If there is a match, the device accepts the frame.
Length field (or Type Field) defines the exact length of the frame’s data field. This is used later as part of the FCS to ensure that the message was received properly. If the purpose of the field is to designate a type as in Ethernet II, the Type field describes which protocol is implemented. (apakah Ethernet II ini lebih baik daripada Ethernet biasa ataukah Ethernet II ini maksudnya adalah FastEthernet yang digunakan sekarang ini, gw kurang tau…feel free to provide me with the Information)
The Data and Pad field (46 – 1500 bytes) contains the encapsulated data from a higher layer, which is a generic Layer 3 PDU, or more commonly, an IPv4 packet. All frames must be at least 64 bytes long. If a small packet is encapsulated, the Pad is used to increase the size of the frame to this minimum size.
The Frame Check Sequence (FCS) field (4 bytes) is used to detect errors in a frame. It uses a cyclic redundancy check (CRC). The sending device includes the results of a CRC in the FCS field of the frame.
*gw ga ajarin CRC, out of field gw…liat aja di Wikipedia
Initially, Ethernet was implemented as part of a bus topology. Every network device was connected to the same, shared media. In low traffic or small networks, this was an acceptable deployment. The main problem to solve was how to identify each device. The signal could be sent to every device, but how would each device identify if it were the intended receiver of the message?
using MAC Address Structure
MAC Address = 48 bit size
The MAC address value is a direct result of IEEE-enforced rules for vendors to ensure globally unique addresses for each Ethernet device (kita bisa bilang…ini nomor/alamat Mesin). The rules established by IEEE require any vendor that sells Ethernet devices to register with IEEE. The IEEE assigns the vendor a 3-byte code, called the Organizationally Unique Identifier (OUI) (ada 1 pertanyaan CCNA Exam tentang ginian loh…wkwkw kampret kan..ginian jg ditanyain).
IEEE requires a vendor to follow two simple rules:
- All MAC addresses assigned to a NIC or other Ethernet device must use that vendor’s assigned OUI as the first 3 bytes.
- All MAC addresses with the same OUI must be assigned a unique value (vendor code or serial number) in the last 3 bytes.
The MAC address is often referred to as a burned-in address (BIA) because it is burned into ROM (Read-Only Memory) on the NIC. This means that the address is encoded into the ROM chip permanently – it cannot be changed by software. (makanya kadang disebut Physical Address)
However, when the computer starts up, the NIC copies the address into RAM. When examining frames, it is the address in RAM that is used as the source address to compare with the destination address. The MAC address is used by the NIC to determine if a message should be passed to the upper layers for processing. (makanya ada software2/hardware2 buat duplikat MAC address…contohnya aja TP-LINK…ada tuh buat duplicate mac address…biasanya buat Internetan pake Cable modem kek FastNet)
Figure 1 Taken from Wikipedia.org
The source device sends the data through the network. Each NIC in the network views the information to see if the MAC address matches its physical address. If there is no match, the device discards the frame. When the frame reaches the destination where the MAC of the NIC matches the destination MAC of the frame, the NIC passes the frame up the OSI layers, where the decapsulation process take place.
All devices connected to an Ethernet LAN have MAC-addressed interfaces. Different hardware and software manufacturers might represent the MAC address in different hexadecimal formats. The address formats might be similar to 00-05-9A-3C-78-00, 00:05:9A:3C:78:00, or 0005.9A3C.7800 (klo lo liat2 sama…Cuma beda penempatan titk, dash, sama titik dua aja). MAC addresses are assigned to workstations, servers, printers, switches, and routers – any device that must originate and/or receive data on the network.
Hexadecimal Numbering on Ethernet
View MAC Address
Ketik di command prompt > ipconfig /all
Sekarang….coba search…di http://standards.ieee.org/develop/regauth/oui/public.html , MAC address lo siapa yang bikin (LAN Card/ NIC lo manufakturnya siapa?? Dari ketik ipconfig /all, alamat MAC uda diketahui kan ?? nah…3 HURUF pertama adalah kode dari vendor / manufaktur LAN Card / NIC lo)
Oh iya…sebelum lupa….
Ketika host send frame…untuk bisa sampai ke tujuan, tergantung tipe koneksinya (Unicast, Broadcast, Multicast)
- Klo UNICAST= switch/router akan baca DESTINATION MAC & IP Address
- Klo Multicast = switch/router akan baca DESTINATION MAC Address & IP Multicast (224.0.0.1)
- Klo Broadcast = switch/router akan baca BROADCAST MAC & IP Address (FF-FF-FF-FF-FF-FF (dan 255.255.255.255 ga ada IP sama sekali) & 192.168.1. [255] ) – 255: broadcast (kalau subnet mask/prefix nya adalah /24, klo /23, /25, itu itung lagi..bisa dengan VLSM)
Media Access Control in Ethernet (CSMA/CD) – The Process
Collision Domain
Karena metode CSMA/CD sewaktu2 bisa saja terjadi collision, maka kita perlu tahu…daerah mana yang sering terjadi collision
Hub (Multi Port Repeater) = yaitu alat untuk menghubungkan device satu dengan yang lain, 1 Hub = 1 Collision Domain (dikarenakan Hub adalah network devices tipe lama), kalau ga ngerti…penjelasannya ada di bawah ini (Switch)
Switch = fungsi sama dengan Hub, hanya saja karena Switch adalah teknologi baru, dia bisa menghubungkan device yang 1 dengan yang lain dengan resiko ZERO collision, kenapa ?? karena tiap port dalam switch adalah 1 collision domain tersendiri, koq bisa tiap 1 port adalah 1 domain collision sedangkan Hub adalah 1 collision domain tanpa perduli jumlah portnya ??? karena switch bisa menggunakan teknologi multiplexing (memecah data dan mentransfernya tanpa harus tabrakan dengan packet lain), kelemahan dari multiplexing adalah, lebih lambat transfer datanya (kan dipecah2 dulu / segmentasi)
The electrical signal that is transmitted takes a certain amount of time (latency) to propagate (travel) down the cable
Ethernet with throughput speeds of 10 Mbps and slower are asynchronous. An asynchronous communication in this context means that each receiving device will use the 8 bytes of timing information to synchronize the receive circuit to the incoming data and then discard the 8 bytes.
Ethernet implementations with throughput of 100 Mbps and higher are synchronous. Synchronous communication in this context means that the timing information is not required. However, for compatibility reasons, the Preamble and Start Frame Delimiter (SFD) fields are still present.
Type of Ethernet (lebih lengkap)
ARP Process – Mapping IP to MAC Address
ARP means Address Resolution Protocol (Mapping IP to MAC Address), ARP inilah yg dipakai ketika suatu host ingin menemukan host lainnya untuk mengirim datanya
ARP-How it works:
NO ARP Entry at First
Broadcast ARP Frame
Unicast Frame from 10.10.0.3 (owner of destination frame)
Adding MAC Address of Destination Host to its ARP Cache
Done….
Standar ARP “ping” (di windows sih) itu dalah 2 menit, jika “tetangga” menjawab, akan ditambah jadi 10 menit, untuk bisa ping2an lagi
As a broadcast frame, an ARP request is received and processed by every device on the local network. On a typical business network, these broadcasts would probably have minimal impact on network performance. However, if a large number of devices were to be powered up and all start accessing network services at the same time, there could be some reduction in performance for a short period of time. For example, if all students in a lab logged into classroom computers and attempted to access the Internet at the same time, there could be delays. (Overhead on the Media)
In some cases, the use of ARP can lead to a potential security risk. ARP spoofing, or ARP poisoning, is a technique used by an attacker to inject the wrong MAC address association into a network by issuing fake ARP requests. An attacker forges the MAC address of a device and then frames can be sent to the wrong destination. (Security)
Manually configuring static ARP associations is one way to prevent ARP spoofing. Authorized MAC addresses can be configured on some network devices to restrict network access to only those devices listed.
*untuk Spoofing dan ARP Poisoning nanti akan kita pelajari
Miftah Rahman (Go)-Blog 