Day 1

1. MAC Address
2. Sniffer
3. Connecting two computers with a hub, a switch and a router

1. MAC Address

Every NIC has a universally unique MAC address. (Some manufacturers allow user-configurable MAC address.)
Use ipconfig/all (Windows) , ifconfig (Linux) to check MAC address of NIC.

MAC address is 6 bytes (48 bits) long.
First 3 bytes (24 bits) is OUI and is controlled by IEEE (http://www.ieee.org).
NIC manufacture buys OUI from IEEE.
Last 3 bytes (24 bits) is assigend by NIC maker.

NIC maker can be found by using OUI at IEEE website. (http://standards.ieee.org/regauth/oui/index.shtml)


2. Sniffer

A sniffer is a software program that can intercept data going across a computer network. A packet sniffer is also known as network analyzer or a protocol analyzer.

Probably the most popular and free packet sniffer is Wireshark. (http://www.wireshark.org). It was known as Ethereal until recently. Due to trademark issue, the program was renamed.

Free sniffer programs for Unix are tcpdump (Linux/BSD) and snoop (solaris).

Sniffer put NIC into "prosmiscous mode" so that it can see all the data going over the network. Proper setup of network devices (hub, switch or router) is required so that a sniffer can capture data. (Wireshark will NOT properly work with Wifi NIC. )

3. Connecting computers with a hub, and a switch

Computer A, B and C are connected to a network device.

If Computer A sees unicast traffic between Computer B & C, then all three computers are in the same collision domain. The network device will be a hub.

Computer A does not see unicast traffic between Computer B & C but if it sees broadcast traffic from B or C, then all three computers are the same broadcast domain. They are NOT in the same collision domain. The network device will be a switch.

If Computer A does not see unicast or broadcast traffic between Computer B & C, then Computer A is in different broadcast domain from Computer B & C. The network device will be a router.