WHITE PAPER

Network Analysis in Switched Ethernet

Network analyzers give a precise, detailed view of the network and the stations involved in communication. Errors can be found quickly and corrected. However, Switched Ethernet makes LAN analysis more difficult. The protocol analyzer can only "see" part of the data communication and that means that the record of network communication is incomplete. A modular protocol analyzer is the solution: The remote agents record network communication in the remote (sub)networks and the presentation then appears on the local display unit. Protocol analysis in Shared Ethernet A look at classic Ethernet helps to illustrate the problems of Switched Ethernet for protocol analysis. In the first version of Ethernet (10Base2, 10Base5) a coaxial cable was run from station to station. All stations shared the common transmission medium. This was called Shared Ethernet. To keep things running smoothly while the common transmission medium was being accessed, a special access procedure was used: CSMA/CD (Carrier Sense Multiple Access / Collision detection). A station that wants to send data first polls (senses) the medium to see whether it is free (Carrier Sense). Only when this is true does the station send data. If the medium is busy, an attempt is made again later to access the medium. However, the Carrier Sense model does not protect against collisions. It is possible that two (or more) stations want to send data, poll the medium, learn that it is free and begin to send data. If they do this at the same time, a collision occurs – the more stations in the network, the greater the probability of a collision. Collision Detection is used to recognize this multiple access and initiate appropriate countermeasures. Based on a collision detection procedure, the sending station determines whether the data were sent correctly or whether a collision occurred. If the result is negative, sending is terminated and the data are sent again at a later time. This means that the transmission time of data packets is very dependent on the network load and cannot be determined ahead of time. The more collisions occur, the slower the entire network becomes. In addition, data can only be sent in one direction at a time (i.e., only half duplex operation is possible). With 10BaseT networks the coaxial cables manufacturer were replaced by twisted copper cables (twisted pair) and the physical structure changed from a linear structure to a star-shaped structure. A hub serves as the central distributor and each station is connected to the hub with its own cable. But even with this structure, the transmission medium is still divided. This is due to the way hubs function. They use the first layer of the ISO/OSI reference model and do not have addressing mechanisms. When a hub receives a data packet on a port, it does not know exactly where the individual packet is going and just sends it to all ports. The station for which the packet is actually intended accepts the data while all other stations ignore the packet.As you can see, Shared Ethernet is characterized by a logical bus system with which a sending station is "heard" by all other stations. This characteristic of Shared Ethernet makes it very easy to record network communication. The protocol analyzer is connected to any port of the hub and can immediately begin to record all data communication on the network. Like all other stations too, it can always "see" all network communication. All data are available at all ports.