Protocol forest 02 small speakers start broadcasting (Ethernet and Wi-Fi protocols)

Author: vamei Source: http://www.cnblogs.com/vamei welcome reprint, please also keep this statement. Thank you!

 

"The Little horn starts broadcasting." If you know this, you must be the older generation. The "little horn" is a children's broadcast program from 1950s to 1980s. At the beginning of the program, there will be a piece of broadcasting like this: "Children, little speakers start broadcasting !" When I heard this, the children in front of the radio got excited and prepared for the Program: Ethernet protocol and WiFi.

 

We mentioned in the postmaster and post office that Ethernet and Wi-Fi areConnection Layer. At the connection layerFrame)Transmission in units. The frame wraps the data (payload) like an envelope and specifies the recipient address and delivery address. The connection layer implements"LocalCommunity". Let's first look at the Ethernet frame.

 

Ethernet frame format

A frame itself is a finite 0/1 series. It can be divided into header and data (payload) and tail :

preamble

SFD

DST

SRC

type

payload (data)

pad

FCS

extension

Frames are sent/received from start to end in the order above. We will further explain the regions below.

 

Header

The first seven bytes of a frame are calledPreface(Preamble). Each of its bytes is 0xaa (here it is a hexadecimal system, that is, 10101010 of the binary system ). Generally, we reserve a 0/1 series (such as 10 bits per second) sent at a certain frequency ). If the receiving device receives messages at other frequencies (such as 5 bits per second), 0/1 of the information to be received will be missed by mistake. However, due to different NICs, the sender and receiver may be physically deviated from each other even if the reservation frequency is the same. This is as if two people had an appointment at. The result is that one table is fast and one table is slow. The preface is to allow the receiving device to adjust the receiving frequency so thatConsistent with the frequency of the sending deviceThis process is called Clock Recovery (recover the clock ).

(Just like adjusting the button until the sound is clear before listening to the broadcast. The NIC will constantly fine-tune its receiving frequency during the process of receiving the preface until it "hears"... 1010 ...)

After the clock is adjusted, we wait for the frameStart Signal(SFD, Start frame delimiter ). SFD is a fixed value 0 x AB. This 0xab is like "The Little horn starts broadcasting", reminding us that the program is coming soon.

Preamble and SFD

Followed by SFD is 6 byteDestination(DST, Destination) and 6 bytesDeparture location(SRC, Source ). This is what we introduced in the postmaster and post office. We wrote the destination and departure address for the envelope. Note that the "local description" of the address, that is, the MAC address, is written on the envelope.MAC addressIt is the serial number that comes with the physical device and can only be identified in the same Ethernet (just as the postman is only familiar with his own community ).

The last area of the header isTypeTo describe the type of the Data part. (For example, 0x0800 is IPv4 and 0x0806 is ARP)

 

Data

Data generally contains data that complies with higher-level protocols, such as IP packets. The connection layer protocol itself does not care about what the data is. It is only responsible for transmission. Note that the end of the data may be filled with a string of 0 (PAD area ). The reason is that the data must exceed a certain minimum length.

 

Tail

What follows after the data isVerification Sequence(FCs, Frame check sequence ). The verification sequence is used to check whether an error occurs during data transmission. In the physical layer, we use some physical signals to represent the 0/1 sequence (such as high voltage/low voltage, high frequency/low frequency), but these physical signals may be affected during transmission so that an error occurs. How can we find that our data is correct?

One way is to send the data twice and compare whether the data is the same. However, this greatly reduces the network efficiency. FCS uses CRC (cyclic redundancy check)Algorithm. It seems like a hotel owner has hired a cashier, but he is worried about the cashier's money. However, the daily turnover is very large. Even if the boss is sitting next to it, he cannot remember the total number of messages received. So he took a clever way: Just remember to receive the moneyLast digit(For example, if you receive 19 RMB, remember 9 ). When there is a new revenue (for example, 13, the ending number is 3), he will add the new ending number and the old ending number, and then remember the ending number (that is, 2 ). When the cashier gives the money to the boss, the boss only needs to check whether the last one in the total amount is the same as the last one in his/her mind, so that he can know whether the cashier is honest. If our data is the total amount of cash, our FCS is the ending number recorded by the boss. If the two do not match, we know that the data is incorrect during transmission and cannot be used.

You have a visual system disk.

 

The above metaphor is actually to get the final ending number by dividing the total business amount by 10. The CRC algorithm is similar. The N-bit CRC algorithm obtains an N-bit factor, for example, the following 1011. N-1-1 zeros are added at the end of the data sequence. The factor and data sequence are constantly operated on XOR until the remainder of N-1 bits is obtained, that is, 100. The remainder is reversed (011) and then stored in the position of the FCS.

 11010011101100   000   <  --  -Three digits 0 are added at the end of the data sequence.  1011                 <  --  -Factor  01100011101100   000  <  --  -XOR result   1011                <  --  -Factor  00111011101100   000    1011  00010111101100   000     1011  00000001101100  000         1011  00000000110100   000          1011  00000000011000   000           1011  00000000001110   000            1011  00000000000101   000             101   1  --  ---------------  00000000000000   100   <  --  -Three-digit Remainder 

The above example uses 4-bit CRC. The factor used in Ethernet is32-bitTo achieve better detection results.

 

Hub vs Switch)

The Ethernet uses a hub or switch to transmit frames from the place of origin to the destination. A hub or switch has multiple ports, each of which can be connected to a computer (or other devices ).

HubLike a broadcast station. A computer sends frames to the hub, and the hub forwards the frames to all other ports. Each computer checks whether its MAC address conforms to DST. If not, keep silence. A hub is an earlier Ethernet device. It has obvious defects:

1) communication between any two computers on the same Ethernet isPublic. It is unsafe for all devices connected to the same hub to hear what others are transmitting. You can improve security by encrypting information.

2)Not AllowedMultiple ChannelsAt the same timeCommunication. If the two computers send messages to the hub at the same time, the hub sends a "Conflict" message to all devices to remind them of a conflict. You can add a conflict detection algorithm (collision detection) on the device: Once a device finds a conflict, it will wait for a period of time and resend it.

SwitchOvercome the defects of the hub. The switch records the MAC addresses of each device. When a frame is sent to the switch, the switch checks DST and thenSend only to the corresponding port. Switch allowedMulti-channel simultaneous communication. Due to the superiority of the switch, the switch basically replaces the hub. However, the old Ethernet may still be using a hub.

The following video is from Cisco, which further explains the two devices.

Http://v.youku.com/v_show/id_XNDgwNTQ5OTI4.html

 

WiFi

WiFiWorks in a similar way as Ethernet in a Hub Connection. One WiFi device sends frames to all WiFi devices, and other WiFi devices check whether they match DST. Because WiFi uses a radio signal, it is difficult to send it in the same way as a switch.SecurityIt is worth noting. Wi-Fi uses encryption to ensure information security.

(Early WEP encryption methods were very fragile. We recommend that you use WPA or wpa2 encryption methods. It is not useful to hide the Wi-Fi device ID .)

 

Summary

We have gone deep into some details of the connection layer protocol. The connection layer is a physical and logical interface. It is designed to meet both physical requirements (such as clock recovery and CRC) and logical requirements (such as addresses and data ). Because the connection layer is at the bottom of the network logic, there are many attack methods based on the connection layer, which requires us to have a certain understanding of how the connection layer works, to design a better network security policy.

 

Welcome to the "protocol Forest" Series