Ethernet, cabling and switching basics

Behind the office door at Ridgeline is a small wall cabinet: a patch panel with twenty-four numbered sockets, a managed switch with twenty-four ports and four extra uplink slots, a tangle of short blue and yellow patch cables, and the firewall-router on a shelf below. Every wired device in the building, from the tills to Kai's roast controller, ends up here. Sam's first job is to work out which socket goes where, why two cables are yellow, and what the blinking lights on the switch mean.

This lesson covers the bottom two layers of the network, where most wired traffic is carried by Ethernet. It explains the cables and connectors, the speeds and distance limits that come with them, how fibre differs from copper, what a MAC address is, how an Ethernet frame is laid out, and how a switch learns where every device is so it can send each frame only where it needs to go. It ends with a first look at VLANs, which let one switch carry several separate networks.

Ethernet

Ethernet is the family of standards, published by the IEEE as 802.3, that defines how devices on a wired local network share a medium, format frames and address each other. It began in the 1970s as a shared coaxial cable that every computer tapped into, became the dominant LAN technology in the 1990s, and has been extended again and again to higher speeds and new media, from 10 megabits per second to 400 gigabits and beyond. The frame format has stayed recognizably the same throughout, which is one reason it has lasted.

Today almost all Ethernet runs in full duplex over point-to-point links: each device has its own cable to a switch port, and each end can send and receive at the same time. The collisions that early shared Ethernet had to detect and recover from, using a method called CSMA/CD, no longer happen on modern switched links. You may still meet the terms half duplex and collision domain in older material and exam questions, and a link stuck in half duplex because of a configuration mismatch is still a classic cause of mysteriously slow transfers.

Copper cabling

Most office Ethernet runs over unshielded twisted pair copper cable: four pairs of thin copper wires, each pair twisted together to cancel electrical interference, ending in eight-pin modular connectors usually called RJ45. Cables are sold in categories that set how much bandwidth they support. The standard maximum length for a copper Ethernet channel is 100 metres, made up of up to 90 metres of permanent cable inside walls plus patch cables at each end.

The wires inside a connector follow one of two colour codes, T568A or T568B. Which one a building uses matters less than using the same one at both ends of every permanent run. A cable wired the same at both ends is a straight-through cable, the normal kind. A crossover cable, with the send and receive pairs swapped, was once needed to connect two switches or two computers directly, but almost every modern port has auto-MDIX, which detects the wiring and adjusts, so crossovers are rarely needed now.

Many switches can also deliver electrical power over the same cable, a feature called Power over Ethernet or PoE. Ridgeline's access points, the office phone and a security camera all draw power from the switch, so they need no electrical outlets on the ceiling. The IEEE PoE standards supply roughly 15 watts per port (802.3af), 30 watts (802.3at, often called PoE+) or up to 60 and 90 watts (802.3bt). Each switch has a total power budget, and a switch can run out of power before it runs out of ports.

budget_w = 370           # total PoE budget of Ridgeline's 24-port switch
devices = [('rl-ap1 cafe access point', 25.5), ('rl-ap2 roastery access point', 25.5),
           ('office phone', 6.5), ('front door camera', 12.95), ('roastery camera', 12.95),
           ('till 1 display', 15.4), ('till 2 display', 15.4)]

used = sum(watts for name, watts in devices)
print('PoE devices:', len(devices))
print('power drawn (watts):', round(used, 2))
print('power left (watts): ', round(budget_w - used, 2))
print('more 25.5 W access points that would fit:', int((budget_w - used) // 25.5))

PoE devices: 7
power drawn (watts): 114.2
power left (watts):  255.8
more 25.5 W access points that would fit: 10

Fibre optic cabling

Fibre optic cable carries data as pulses of light through a hair-thin glass core. Light does not pick up electrical interference, cannot be tapped easily and travels much further than signals on copper, so fibre is used between buildings, between floors, in data centres and for the provider connections that now reach many homes and shops, including Ridgeline's. There are two main kinds. Multimode fibre has a wider core and is used for shorter runs inside buildings, typically up to a few hundred metres at 10 gigabits. Single-mode fibre has a very narrow core and carries light tens of kilometres; it is what providers run down the street.

Fibre connects to switches through small pluggable transceivers, usually called SFP modules (SFP+ for 10 gigabits, QSFP for 40 and 100), which slot into the switch's uplink ports and take a fibre connector, commonly LC. The transceiver must match the fibre type and the module at the other end. Fibre needs care: connectors must be kept clean, cables must not be bent tighter than their minimum bend radius, and you should never look into the end of a fibre or transceiver, because some carry laser light that can damage eyes even when it is invisible.

MAC addresses

Every Ethernet and Wi-Fi interface has a 48-bit media access control address, written as six pairs of hexadecimal digits such as 3c:22:fb:10:00:21 or 3C-22-FB-10-00-21. The first three bytes are the organizationally unique identifier, assigned by the IEEE to the manufacturer, so a MAC address usually reveals who made the network card. The last three bytes are a serial number chosen by the manufacturer. The address is stored in the hardware, though software can override it, and modern phones and laptops deliberately use random MAC addresses on Wi-Fi networks to make it harder to track people from place to place.

Two special kinds of address matter. The broadcast address, ff:ff:ff:ff:ff:ff, means every device on the local network, and switches flood broadcast frames out of every port. Multicast addresses deliver to a group of interested devices. Within the first byte, the lowest bit marks a group (multicast or broadcast) address when it is 1, and the second-lowest bit marks a locally administered address, such as a randomized one, when it is 1. Python's int() function can read the hexadecimal digits, so checking those bits takes one line each.

def describe(mac):
    first = int(mac.replace('-', ':').split(':')[0], 16)
    kind = 'group (multicast or broadcast)' if first & 1 else 'single device'
    origin = 'locally administered, e.g. randomized' if first & 2 else 'factory assigned'
    return kind + ', ' + origin

for mac in ('3c:22:fb:10:00:21', 'ff:ff:ff:ff:ff:ff', '01:00:5e:00:00:fb', 'da:a1:19:42:7e:03'):
    print(mac, '->', describe(mac))

3c:22:fb:10:00:21 -> single device, factory assigned
ff:ff:ff:ff:ff:ff -> group (multicast or broadcast), locally administered, e.g. randomized
01:00:5e:00:00:fb -> group (multicast or broadcast), factory assigned
da:a1:19:42:7e:03 -> single device, locally administered, e.g. randomized

def normalize_mac(text):
    return text.lower()

print(normalize_mac('3C-22-FB-10-00-21'))

The Ethernet frame

An Ethernet frame starts with a preamble that lets the receiver synchronize, then carries the destination MAC address, the source MAC address and a two-byte type field, called the EtherType, that says what is inside: 0x0800 for IPv4, 0x86DD for IPv6 and 0x0806 for ARP. Then comes the payload, from 46 to 1,500 bytes on standard Ethernet, and finally a four-byte frame check sequence, a CRC computed over the frame. The receiver recomputes the CRC and silently drops any frame that does not match, so damaged frames never reach the layers above; the transport layer notices the missing data and arranges for it to be sent again.

Putting the destination address first is deliberate: a switch can start deciding where to send a frame as soon as the first six bytes arrive. Ethernet frames also carry no hop count and no route: they are delivered only within one local network. Getting data between networks is the job of IP and routers, one layer up.

How a switch forwards frames

A switch keeps a table, usually called the MAC address table or CAM table, listing which MAC address was last seen on which port. It builds the table by watching traffic: every time a frame arrives, the switch records its source address against the port it came in on. To forward a frame, the switch looks up the destination address. If the address is in the table, the switch sends the frame out of that one port only, called forwarding or filtering. If the address is unknown, or the frame is a broadcast, the switch floods it out of every port except the one it arrived on. Entries age out after a few minutes without traffic, so devices that move are relearned quickly.

This behaviour is what makes a switch better than the hubs it replaced. A hub repeats every frame out of every port, so all devices share the bandwidth and see each other's traffic. A switch gives each port its own full-speed link and sends unicast frames only where they need to go. Broadcasts still reach every port in the same network, which is why very large flat networks become noisy and why networks are divided into smaller broadcast domains with routers or VLANs.

class Switch:
    def __init__(self, ports):
        self.ports = ports
        self.table = {}

    def receive(self, port, src, dst):
        self.table[src] = port                              # learn where the sender is
        if dst != 'ff:ff:ff:ff:ff:ff' and dst in self.table:
            return [self.table[dst]]                        # known: forward out of one port
        return [p for p in range(1, self.ports + 1) if p != port]   # unknown or broadcast: flood

sw = Switch(4)
print(sw.receive(2, 'laptop', 'till1'))    # till1 unknown yet: flood
print(sw.receive(1, 'till1', 'laptop'))    # laptop was learned on port 2
print(sw.receive(2, 'laptop', 'till1'))    # till1 now known on port 1
print(sw.receive(3, 'printer', 'ff:ff:ff:ff:ff:ff'))
print(sw.table)

[1, 3, 4]
[2]
[1]
[1, 2, 4]
{'laptop': 2, 'till1': 1, 'printer': 3}

def learn(frames):
    table = {}
    for port, src, dst in frames:
        table[dst] = port
    return table

def out_ports(table, port, dst, ports=8):
    return [table[dst]]

t = learn(FRAMES)
print(t, out_ports(t, 2, 'cc:03'))

A first look at VLANs

A virtual LAN, or VLAN, divides one physical switch into several separate layer 2 networks. Each port is assigned to a VLAN by number, and frames are switched only between ports in the same VLAN, so broadcasts in one VLAN never reach another. Traffic between VLANs has to pass through a router or firewall, where rules can control it. Ridgeline already uses one: the guest Wi-Fi is VLAN 50, separate from VLAN 1, which carries every staff device. A guest's infected laptop cannot even see the tills or the office computers, because they are on a different layer 2 network. Sam would like to go further and give the card terminals and tills a VLAN of their own, a change planned in Lesson 12.

When one cable has to carry several VLANs, for example between the switch and the firewall-router or between the switch and an access point that broadcasts both the staff and guest Wi-Fi, the link is configured as a trunk. Frames on a trunk carry a four-byte 802.1Q tag holding the VLAN number, so the device at the other end knows which network each frame belongs to. Ordinary device ports are access ports: they carry one VLAN and send frames untagged, so the connected device needs no VLAN knowledge at all. VLANs, trunking and inter-VLAN routing are covered in depth in the next course, Routing and Switching I; for now it is enough to know that Ridgeline's plan in Lesson 12 uses five of them.