Section 2.1.b Implement and Troubleshoot Layer 2 Protocols
One thing I wanted to discuss in this section is Ethernet, and all of the forms it may take.
When looking at wireshark captures, we may notice the Ethernet headers as “Ethernet II”. This is the most common Ethernet protocol we use today.
The above screenshot is nothing fancy, it’s the plain old Ethernet protocol we often see.
However when looking at some L2 protocols, like CDP, DTP, STP we may notice these encapsulated by a different “Ethernet”.
In this particular case I am using an MST BPDU from an Arista switch, however notice the encapsulation? IEEE 802.3 Ethernet.
You will find this often with switch to switch communication protocols developed by the IEEE, especially old ones. They still tend to use the IEEE 802.3 Ethernet
even though it never really took off.
Here is some information regarding those Ethernet protocols from the cisco form
”
DstMAC, SrcMAC, EthType, Data, FCS: Ethernet II, Ethernet DIX, Ethernet 2
DstMAC, SrcMAC, Length, Data, FCS: IEEE 802.3 (not really usable, just a basic container)
DstMAC, SrcMAC, Length, DSAP, SSAP, Control, Data, FCS: IEEE 802.3 + IEEE 802.2 LLC
DstMAC, SrcMAC, Length, DSAP, SSAP, Control, OUI, ProtoID, Data, FCS: IEE 802 SNAP
”
The jist if this information is you should be aware of 802.3 Ethernet and Ethernet II.
Another thing I wanted to mention here is link autonegotiation.
Autonegotation allows us to determine duplex and speed based on fast link pulses that NICs use.
Certain pulses mean certain settings like half duplex or full duplex (if they both have full they will agree to full)
It can also determine interface speed, they will agree on the fastest speed supported by both.
If one side of the link is hard coded (duplex and speed) then the auto neg side will failback to half duplex, but it can detect the correct speed.
If these are Cisco devices and they have CDP enabled (by default) they will warn create syslog messages about duplex issues.
2.1.b Implement and Troubleshoot Layer 2 Protocols