Access to a network media - MAC address

 Back  TCP / IP  Next

To created a package into a signal passes through another processing in NETWORK ACCESS layer. Adds the MAC (Media Access Control) address of the source and destination. MAC address of the source computer. A target? To clarify the above is best to look at what produces the command IPCONFIG /ALL (Windows XP/Vista/7).

 IPConfig command
Figure 7.4.7 Configuration Data of computer.

An established data communication occur to the previous figure. These data are not available if the computer is actively connected to the network. Although it is a computer attached to a network modem (like it would be for the NIC) is significantly small amount of information.

Each package NETWORK ACCESS layer adds its own header, which consists of source and destination MAC addresses, mark the length or data type of the data (DATA) and checksums (FSC), which is written at the end. This data set is called FRAME, and has almost the same structure for all types of Internet traffic. The minimum amount of data in DATA field is 46 B and the maximum is 1500 B. The minimum amount of data is defined to a computer or other network device has had enough time to complete encapsulation (extract data from the higher layers of the OSI model), and if the data is less than 46 B are added to the bytes to fill (padding bytes). Value of 1500 B is called MTU (Maximum Transition Unit).

It can be calculated that the frame of the large 64 B - 1518 B to synchronize before FRAME 'release' the Preamble (8 times 10101010) and SFD (Start Frame delimiter - 10101011). Preamble is also advert (broadcast) to all other computers on the local network 'Here follows FRAME!' in order to draw attention to await the signal from the data and that they should rest with its transmission. FRAME send to the media (wired or optical) for NIC and turns ones and zeros into a digital signal that it sends to media. NIC is the device that is the second layer of the OSI model. Frame structure of is shown in the following table.

7 1 6 6 2 46 - 1500 4
Preamble S
Data + Padding FCS
Structure of an Ethernet frame in bytes.

If a network device that connects computers SWITCH, it applies in its internal table called CAM (Content Addressable Memory) into RAM learns and preserves the MAC addresses and associated number of Ethernet ports (the ports of no data than RJ45 connector) for each connected computer. If the destination address is learned and known switch on the ground that connects two computers and computers are exchanged among FRAME's. Establishes a separate virtual communication. If the switch does not have a destination MAC address, or can not find on their port's, sent the FRAME to following network device, so everything is still up to the exit from the local network via a router. Ethernet address of the router's MAC address and the output is called the 'Gateway'. How router belongs to the devices that work with IP addresses, 'gateway' to the computer configuration is defined as an IP address. Router compares the IP address entered into the FRAME with networks connected to it in order to know where to send the frame. So must decapsulation FRAME to read the destination IP address and calculated based on the 'routing' protocol encapsulation again made into a frame but with the new MAC address of the next network device.

How Router performs the decapsulation and encapsulation process to find out the IP address belongs to the devices of the third layer of the OSI model. In this process of reading the IP address, MAC address will be change depending of who is the new destination. So MAC address of computer is not transmitted outside the local network and limit device is a router. Basically switch as previously described belonged to the second layer of the OSI model because it does not work described replacement of the MAC address.

However, if computers are connect to HUB, which has no possibility of CAM, computers connected to it listen to the traffic on all its ports and waiting when it will occur 'silence' to send your signal to the media. If the signal is a conflict with another signal from another computer dispatched at approximately the same time, there will be a COLLISION and both computers will stop sending frame for a while and wait for the 'clean' situation on the media to restore sending. A lot of computers connected to the HUB increases the possibility of conflict and leads to a drop in network performance, due to their 'fun around the collision'. Interconnected devices without CAM capabilities along with their computers connected to the port's make a unique collision domain. SWITCH by 'intelligence' to direct traffic from each port a real one collision domain, thus drastically reducing them in volume but the total number of collision domains increases, which is intended to reduce the amount of collisions. Of course everything has its price. SWITCH is considerably more expensive than the HUB. As technology has progressed, the difference in cost is less and less so in the design of new networks are increasingly used SWITCH instead HUB.

If the HUB is concerned, he does not know and can not learn the MAC destination, and that the PC does not even remember (basically) need is some way to find out. Therefore, the source computer initializing communication sends frame in which the destination address set to the broadcast address of FF-FF-FF-FF-FF-FF that all computers in the network suggests that the source computer wants to communicate. NIC is designed to let the frame which is related to:

Individual bytes / octets of MAC address have the following meanings:

6th B /  (MSB)
1st octet
5th B
2nd octet
4th B
3rd octet
3rd B
4th octet
2nd B
5th octet
1st B /  (LSB)
6th octet
OUI (Organisationally Uniqe Identifier) NIC specific (Serial Number)
7 6 4 4 3 2 1 0
  b0 = 0 - Unicast
  b0 = 1 - Multicast
  b1 = 0 - Globally Unique (OUI enforced)
  b1 = 1 - Locally Administered
Structure of an MAC address

Thus, the appropriate operating range, with specified exceptions, for local application of address is: 00:00:00:00:00:01 to FF:FF:FF:FF:FF:FD. It has been said that the use should not be used, nor produce, network card with the same MAC address.

All network cards are accepted and forwarded broadcast FRAME to higher layer since frame has accepted. Frame from a higher layer in the computer performs decapsulation and the third layer of the OSI model insights the corresponding IP address. Computer builds a table that describes the MAC-IP pairs and is called the ARP table. Computer built ARP table in RAM and occasionally by ARP (Address Resolution Protocol) requests not to send you to gain knowledge of the new members of the network. Computer keeps 10-100 MAC-IP address or discovered in this way. So if there are about one thousand computers produced ten ARP requires a second, again can choke network. Second layer protocols are ARP, RARP (Reverse ARP) and NDIS (Network Driver Interface Specification).

When the IP layer (third layer of OSI) recognized by the destination computer, the destination IP address that the call is related to it, the source returns a response with its frame in which is his destination MAC address. Now can be transferred data between the source and destination (DATA FRAME) based on the MAC address as both are known at one and other computer. Rest of computers refuse data frame because the destination address does not match with their MAC address. This is accompanied by SWITCH, and he will keep in his memory and to MAC address in its table assign each of its port to which the computer is connected with that address. Better device can save ten thousand PORT-MAC address. This is one of the great advantages of SWITCH in relation to the HUB because according that famous MAC-PORT pairs (CAM) can make a separate independent connections.

To prevent this requires a bunch of ARP should be restricted, and it works ROUTER, which does not transmit broadcast and that's usually a way out of the local network. If however the local network is too large can be placed inside it has a router to reduce the scope of a broadcast. So, all devices and computers that transmit broadcast frames create the complete entity that is called BROADCAST DOMAIN.

As more computers in the network, the router uses the NETWORK MASK to be grouped and treated as a single address - NETWORK ADDRESS. This is another piece of information need of a computer and router, and is made on the basis of calculation between the registered IP address of the computer and network mask entered as to these two addresses the application of a logical AND operation. Of course, the logical operations performed in binary, and the the decade views address only to aid understanding of the man. It is necessary to define and address of the DNS server that has a table in which keeps couples host name and its domain name - IP address of the computer, because some services without this would not work. There are other types of network devices, but on the next chapter.


According to Figure 7.4.6 it is evident that in the process of sending data, the data are divided into smaller groups that are sequentially when preparing to send over a network by adding different headers prescribed or recommended rules - protocols relevant international institutions, in particular receiving of data header during their processing of acceptance from a computer network to acceptance by the destination program support discarded. The process of adding certain sequence header is called encapsulation, and the process of separating certain sequence header is called decapsulation.

So, to achieve communication needs the following:

  • Networked computer OS which supports
    TCP / IP protocol suite
  • Appropriate software regarding preparation of data
  • Encrypting the data as needed
  • Source port 1024-65535
  • Destination port 1-1023
  • Source IP address (32 bits)
  • Destination IP address (DDD.DDD.DDD.DDD)
  • Source MAC address (48 bits)
  • Destination MAC address (HH-HH-HH-HH-HH-HH)
  • Monitoring data traffic (simplex, duplex, window size ...)
  • Control of errors (CRC, acknowledgment ...)
  • And some other things for initialization,
    agreement and confirmation of communication

A core set of software (computer programs), protocols and modes of communication, which are the basis of network connection, it can be TCP / IP with the scheme shown by the following table:

Application Telnet FTP LDP NFS Rest
Host-to-host TCP UDP
Internet IP ICMP  
Host-to-network Ethernet Token-Ring FDDI Rest

True, Telnet as a service in its original form is almost not used, except in special cases where security is guaranteed (through the communication of network devices), but the use of the products, which have a similar presentation to the user with access to the encrypted traffic, an SSH client on instance. Of course, for something more than this, as easy as a lot of articles and discussions on the Internet. Just takes a little look. Use Google?


 Content - Home
 Content  Informatics Alphabet
Citing this page:
Radic, Drago. " IT - Informatics Alphabet " Split-Croatia.
{Date of access}. <>.
Copyright © by Drago Radic. All rights reserved. | Disclaimer