RE: CSMA/CD

["David Gillett" <gillettdavid () fhda edu>]

  What I was calling "pad" turns out to be officially called
"preamble", 8 bytes added in front of the 18 for a minimal
ping packet (which yes, does also need to be padded to 64
bytes).  Sorry for the confusing terminology.

  Coincidentally(!), this preamble which starts every Ethernet
frame looks EXACTLY like the "jam" signal people are claiming 
gets sent.  The only difference is one of semantics:  The 
preamble is sent by a host that thinks the wire is clear and
it's about to send, and the "jam" is sent by a host that has
tried to send the preamble and detected a collision.  But
since it was already sending preamble, there's no need to stop
and send "jam" -- just abort the frame and go into pause-retry.
  (The size of the preamble is designed to let any collision 
detection occur before any of the packet data is sent.  If
two stations can hear clear wire, start sending preamble, and
one of them runs out of preamble and starts sending data before
the other's preamble arrives and the collision is detected, then
your segment violates the 3-4-5 rule or the maximum cable run 
specs; you need to add a bridge or other non-passive device.)

David Gillett

> -----Original Message-----
> From: Ansgar Wiechers [mailto:bugtraq () planetcobalt net]
> Sent: August 22, 2003 01:31
> To: Security-basics () securityfocus com
> Subject: Re: CSMA/CD
>
>
> On 2003-08-21 David Gillett wrote:
> > Before a CSMA/CD device transmits, it listens to hear that 
> the wire is
> > clear.  (If it isn't, it waits for a while and listens again.)
> > There's a potential race condition where two (or more!) devices
> > listen, find that the wire is clear, and both decide to 
> transmit. Part
> > of resolving this race condition is for each frame transmission to
> > start with a "pad" of known filler.
>
> I may be wrong here, but AFAIK this is not the way padding works.
>
> Say you have two stations located at the two furthermost ends of the
> ether. If one station starts sending, the signal takes some time to
> propagate (since it travels with approximately 0,6 light speed only).
> Now assume the other station starts sending right before the signal
> reaches its port. In the next moment it will receive the first signal,
> detect a collision (this is implemented in hardware AFAIK - something
> like an XOR gate between input and output - since software 
> would not be
> responsive enough to accomplish this task) and a jam signal is sent.
> This station is aware of the collision now, but the first 
> station still
> is not! Only when it receives the signal the second box sent before
> finishing its own transmission, it will be able to detect that a
> collision occured. This is accomplished by defining the minimum frame
> size (64 byte) large enough to make sure a station keeps sending at
> least the time a signal needs to cover twice the maximum segment size
> ("there and back again").
>
> So where does pad fit in here? Unfortunately, en empty eternet frame
> (headers only) is smaller than 64 byte (just 18 byte: destination
> address, source address, type, FCS), so every frame smaller 
> than 64 byte
> is filled up with zeroes (or maybe even garbage, I'm not sure) to have
> the required minimum size. This fillup is called pad.
>
> Regards
> Ansgar Wiechers
>
> --------------------------------------------------------------
> -------------
> --------------------------------------------------------------
> --------------
>
>
> ______________________________________________________________
> __________
> This email has been scanned for all viruses by the MessageLabs Email
> Security System. For more information on a proactive email security
> service working around the clock, around the globe, visit
> http://www.messagelabs.com
> ______________________________________________________________
> __________
>
> --------------------------------------------------------------
> -------------
> Attend Black Hat Briefings & Training Federal, September 
> 29-30 (Training), 
> October 1-2 (Briefings) in Tysons Corner, VA; the world's premier 
> technical IT security event.  Modeled after the famous Black 
> Hat event in 
> Las Vegas! 6 tracks, 12 training sessions, top speakers and 
> sponsors.  
> Symantec is the Diamond sponsor.  Early-bird registration 
> ends September 6.Visit us: www.blackhat.com
> --------------------------------------------------------------
> --------------

---------------------------------------------------------------------------
Attend Black Hat Briefings & Training Federal, September 29-30 (Training), 
October 1-2 (Briefings) in Tysons Corner, VA; the world's premier 
technical IT security event.  Modeled after the famous Black Hat event in 
Las Vegas! 6 tracks, 12 training sessions, top speakers and sponsors.  
Symantec is the Diamond sponsor.  Early-bird registration ends September 6.Visit us: www.blackhat.com
----------------------------------------------------------------------------