| Home | What to Know for the CCNA | Study Notes 1 | Study Notes 2 | Study Notes 3 | Internetworking Basics |

CCNA Study Sheet 3

OSI Reference / Network Protocols


Application The application layer provides services directly to applications. The functions of  the application layer can include identifying communication partners, determining resource availability, and synchronizing communication . Some examples of application layer implementations include TCP/IP and OSI applications such as Telnet, FTP, and SMTP, File Transfer, Access, and Management (FTAM), Virtual Terminal Protocol (VTP), and Common Management Information Protocol (CMIP).
Presentation The presentation layer provides a variety of coding and conversion functions that are applied to application layer data. These functions ensure that information sent from the application layer of one system will be readable by the application layer of another system. Examples of presentation layer coding and conversion schemes include ASCII, EBCDIC, JPEG, GIF, TIFF, MPEG, QuickTime, various encryption methods, and other similar coding formats.
Session The session layer establishes, manages, maintains, and terminates communication sessions between applications. Communication sessions consist of service requests and service responses that occur between applications located in different network devices. Some examples of session layer implementations include Remote Procedure Call (RPC), Zone Information Protocol (ZIP), and Session Control Protocol (SCP).
Transport The transport layer segments and reassembles data into data streams. It is also responsible for both reliable and unreliable end-to-end data transmission. Transport layer functions typically include flow control, multiplexing, virtual circuit management, and error checking and recovery. Some examples of transport layer implementations include Transmission Control Protocol (TCP), Name Binding Protocol (NBP), and OSI transport protocols (SPX).
Network The network layer uses logical addressing to provide routing and related functions that allow multiple data links to be combined into an internetwork. The network layer supports both connection-oriented and connectionless service from higher-layer protocols. Network layer protocols are typically routing protocols. However, other types of protocols, such as the Internet Protocol (IP), are implemented at the network layer as well. Routers reside here at the network layer. Some common routing protocols include Border Gateway Protocol (BGP), Open Shortest Path First (OSPF), and Routing Information Protocol (RIP). Packets and datagrams are sent across this layer of the OSI model (IPX).
Data Link The data link layer provides reliable transmission of data across a physical medium. The data link layer specifies different network and protocol characteristics, including physical addressing, network topology, error notification, sequencing of frames, and flow control. The Data link layer is composed of two sublayers known as the Media Access Control (MAC) Layer and the Logical Link Control (LLC) layer.
This can be seen in the diagram to the right:

The MAC sublayer manages protocol access to the physical network medium. The IEEE MAC specification defines MAC addresses, which allow multiple devices to uniquely identify one another at the data link layer.
The LLC sublayer manages communications between devices over a single link of a network. LLC supports both connectionless and connection-oriented services used by higher-layer protocols.
 
Data link layer implementations can be categorized as either LAN or WAN specifications. The most common LAN data link layer implementations include Ethernet/IEEE 802.3, Fast Ethernet, FDDI, and Token Ring/IEEE 802.5. The most common WAN data link layer implementations include Frame Relay, Link Access Procedure, Balanced (LAPB), Synchronous Data Link Control (SDLC), Point-to-Point Protocol (PPP), and SMDS Interface Protocol (SIP).
Physical The physical layer defines the electrical, mechanical, procedural, and functional specifications for activating, maintaining, and deactivating the physical link between communicating network systems.
Physical layer specifications define such characteristics as voltage levels, timing of voltage changes, physical data rates, maximum transmission distances, and the physical connectors to be used. Physical layer implementations can be categorized as either LAN or WAN specifications. Some common LAN physical layer implementations include Ethernet/IEEE 802.3, Fast Ethernet, FDDI, and Token Ring/IEEE 802.5. Some common WAN physical layer implementations include High-Speed Serial Interface (HSSI), SMDS Interface Protocol (SIP), and X.21bis.


Steps of Data Encapsulation:

  1. User information is converted to data

  2. Data converted to segments

  3. Segments converted to packets or datagrams

  4. Packets and datagrams are converted to frames

  5. Frames are converted to bits

Data link addresses: Physical address. Flat addressing scheme where the physical address is burned into a network card (MAC address)
Network address: Logical address. IP or IPX - hierarchical scheme. The address is assigned to a machine manually or dynamically.

Physical through Transport layers are the Data Flow Layers
Session through Application layers are the "Application" (Upper) Layers
Hubs work on the Physical layer (Layer 1 device)
Switches and Bridges work on the Data Link Layer (Layer 2 device)
Routers work on the Network layer (Layer 3 device)

Network Structure Defined by Hierarchy

Core Layer = Multi-layer switch: Purpose is to switch traffic as fast as possible
Characteristics:

  • Fast transport to enterprise services (e-mail, internet access, video conferencing)

  • No packet manipulation

Distribution Layer = Routers:
Primary function: perform potentially "expensive" packet manipulations such as routing, filtering, and WAN access.
Characteristics include:

  • Access Layer Aggregation Point

  • Routing traffic

  • Broadcast/Multicast Domains

  • Media Translation

  • Security

  • Possible point for remote access

Access Layer = Switches and Routers:
End station entry point to the network

IPX
To turn on:

<> ipx routing

Then, on interface:

ipx network {#} encapsulation {sap, arpa, snap, hdlc, novell-ether} {sec} ipx network 3100 encapsulation sap sec

To monitor:

<> sh ipx traffic sh ipx int e0

Frame Types:
802.3 -              novell-ether - default
802.2 -              sap
Ethernet_II -      arpa
Ethernet_snap -  snap
 

LAN Switching
Switching: examines MAC address. Same as multiport bridge.
Three Switch Functions:

  1. Address learning

  2. Forward/filter decision

  3. Loop avoidance

Address Learning: maintains MAC address table used to track the location of devices connected to the switch.

Forward/filter decision: when a frame arrives with a known destination address, it is forwarded only on the specific port connected to that station.

Broadcast and Multicast frames: may be of interest to all stations. The switch normally floods to all ports other than the origination port. A switch never learns a broadcast or multicast address because broadcast and multicast addresses never appear as the source address of a frame.

All nodes on an Ethernet network can transmit at the same time, so the more nodes you have the greater the possibility of collisions happening. This can slow the network down.

Redundant Topology - eliminates single points of failure. Causes broadcast storms, multiple frame copies, and MAC address table instability problems.

Multiple Frame Copies - when a new switch is added, the other switches may not have learned its correct MAC address. The host may send a unicast frame to the new switch. The frame is sent through several paths at the same time. The new switch will receive several copies of the frame. This causes MAC Database Instability.

MAC Database Instability - results when multiple copies of a frame arrive on different ports of a switch.

Multiple Loop Problems - complex topology can cause multiple loops to occur. Layer 2 has no mechanism to stop the loop. This is the main reason for Spanning-Tree Protocol.

 Spanning-Tree Protocol (STP) IEEE 802.1d.
Developed to prevent routing loops. STA (Spanning-Tree Algorithm) is implemented by STP to calculate a loop-free network topology. In most switches, BPDUs (Configuration Bridge Protocol Data Unit), are sent and received by all switches, and processed to determine the spanning-tree topology. (STP is on by default).
A port is in either a forwarding or blocking state. Forwarding ports provide the lowest cost path to the root bridge. All ports start in the blocking state to prevent bridge loops. The port stays in a blocked state if the spanning tree determines that there is another path to the root bridge that has a better cost.
Blocking ports can still receive BPDUs.

Spanning-Tree operation: Selects one root bridge. All the ports are designated ports (forwarding). For non-root bridge, there will be one root port. This offers the lowest cost path from non-root bridge to the root bridge. On each segment, there is one designated part. This port also has the lowest cost to the root bridge.

Time to Convergence - the time for all the switches and bridges ports transition to either the forwarding or blocking state. When network topology changes, switches and bridges must re-compute the Spanning-Tree Protocol, which disrupts traffic.

Bridging Compared to LAN Switching

Bridging: primarily software based. One spanning-tree instance per bridge. Usually up to 16 ports per bridge.

LAN Switching: primarily hardware based. Many spanning-tree instances per switch. More ports per switch, (up to 100). Faster than a Bridge.

Transmitting Frames through a Switch

Store-and-Forward - copies entire frame into buffer, checks for CRC errors. Higher latency.

Cut-Through - reads only the destination address into buffer, and forwards immediately. Low latency.

Fragment free - (modified cut-through). Switch will read into the first 64 bytes before forwarding the frame. Collisions will usually occur within the first 64 bytes. (default for 1900 series).

Full-Duplex Ethernet - can provide double the bandwidth of traditional Ethernet, but requires a single workstation on a single switch port, and NIC must support it. Collision free because there are separate send and receive wires, and only one workstation is on the segment. Half-Duplex must provide for collision detection, therefore can only use 50% of bandwidth available. It sends and receives on the same set of wires.

LAN Segmentation: breaking up the collision domains by decreasing the number of workstations per segment.

Fast Ethernet (100bt) - provides 10 times the bandwidth of older 10bastT Ethernet. Must have Cat5 cable, no longer than 100 meters, and Fast Ethernet NIC's and Hubs/Switches.

Bridges - examines MAC address, and forwards frames unless the address was local. Forwards to all other segments it is attached to. Forwards multicast packets, so broadcast storms can occur.

Routers - examines network address, and forwards using the best available route to destination network. Can have multiple active paths.

Virtual LAN's - sets different ports on a switch to be part of different sub-networks. Some benefits: simplify moves, adds, changes; reduce administrative costs; have better control of broadcasts; tighten security; and distribute load. Relocate the server into a secured location.

 TCP/IP Layers
Application Layer: File transfer, E-Mail, Remote Login, Network Management, Name Management.

Transport Layer: TCP (connection oriented), UDP (Connectionless).

Flow control provided by sliding windows. Reliability provided by sequence numbers and acknowledgements.

Port Numbers: Used to pass information to the upper layers.

TCP:

  • FTP - 21

  • Telnet - 23

  • SMTP - 25

  • DNS - 53

UDP:

  • DNS - 53

  • TFTP - 69

  • SNMP - 161

  • RIP - 520

Numbers below 1024 are well known ports. Above 1024 are dynamically assigned ports.
Registered ports are for vendor specific applications: usually above 1024.

Internet Layer - Corresponds with OSI Network layer

  • IP provides connectionless, best-effort delivery routing of datagrams

  • ICMP provides control and messaging capabilities

  • ARP determines the data link layer address for known IP address

  • RARP determines network address when data link layer addresses are known

IP Address Classes:
Class A
Net.Node.Node.Node
0
1 - 126
126 networks, 16M nodes
Class B
Net.Net.  Node.Node
10
128 - 191
16K networks 65K nodes
Class C
Net.Net.  Net.  Node
110
192 - 223
2M networks 254 nodes

Subnetting Formulas: (count the bits only from the Node portion of the address.
Therefore, for a Class B address, the total masked bits + unmasked bits = 16): 

Max # of Subnets: 2(masked bits)-2 
Max # of Hosts (per subnet): 2(unmasked bits)-2

Routing
Routers must learn destinations that are not directly connected.

Static (manual): Uses a route that the network administrator enters manually. (Must be setup bi-directional)
Enter the IP Route command in global configuration mode

ip route {destination network} {mask} {port, on remote side, to get there} ip route 172.16.10.0 255.255.255.0 172.16.40.1

Dynamic: Uses a route that a network routing protocol adjusts automatically
router rip
network 172.16.0.0

router igrp {autonomous system #}
network 172.16.0.0

To monitor, sh ip route {rip / igrp}

Routing Protocols
 Interior (within an autonomous system (AS) group of routers under the same administrative authority)

  • Distance Vector understands the direction and distance to any network connection on the internetwork. Knows how many hops (the metric) to get there. All routers w/in the internetwork listen for messages from other routers, which are sent every 30 to 90 seconds. They pass their entire routing tables.
    Possible problems: Slow convergence, Routing Loops, Counting to Infinity (this is solved by maximum hop count).
    Solutions: Split Horizon (cannot send information back in the direction it was received); Hold-Downs (prevent regular update messages from reinstating a route that has gone down). Uses hop count for measurement.

    • RIP - 15 hop count max

    • IGRP - 255 hop count max, uses reliability factor (255 optimal), and bandwidth

  • Link State - understands the entire network, and does not use secondhand information. Routers exchange LSP's (hello packets). Each router builds a topographical view of the network, then uses SPF (shortest path first) algorithm to determine the best route. Changes in topology can be sent out immediately, so convergence can be quicker. Uses Bandwidth for measurement.

    • OSPF - decisions based on cost of route (metric limit of 65,535)

    • EIGRP - hybrid protocol (has features of Distance Vector and Link State protocols), Cisco proprietary

Exterior

  • EGP (Exterior Gateway Protocol)

  • BGP (Border Gateway Protocol)

Counting to Infinity

  • Define a limit on the number of hops to prevent infinite loops

  • Split Horizon (never sends information about a route back the same direction in which it was received)

  • Route Poisoning (Routers set the distance of routes that have gone down to infinity. Used with hold-down timers)

  • Hold-Down Timers (Router keeps an entry for the network possibly down state, allowing time for other routers to re-compute for this topology change)

  • Poison Reverse (overrides split horizon. Informs the sending router that the destination is inaccessible)

  • Triggered Updates (Sends updates when a change in its routing table occurs. Does not wait for the prescribe time to expire

IOS / Routing / Network Security

  • Cisco IOS (operating system) is stored in flash memory (EEPROM)

  • IOS configuration is stored in NVRAM

Top