Introduction Chapters four and five introduce a family of intermediate devices. These devices -- repeaters, bridges, routers, and gateways -- are the tools used to link network segments together to form larger and more complex networks. Each type of device is best suited to overcoming a limitation in the network. Repeaters are used to overcome distance and station-count limitations. Bridges divide larger networks into segments to increase efficiency and traffic flow. Routers join networks with different channel access methods and incorporate WAN links. Gateways are used to link systems that share no protocols in common. These devices are the more sophisticated tools in the network engineer's toolbox. Following the text's bottom-up method, this chapter deals with repeaters and bridges; layer one and layer two devices respectively. Repeaters Ethernet 5-4-3 Rule Stackable Hubs Bridges Transparent (Learning) Bridges Source-Route Bridges The 80/20 Rule Spanning Tree Algorithm WAN Bridges
			[ I ] REPEATERS Every network technology has limitations. Repeaters tackle network limits in the form of maximum segment lengths, and maximum station count. In its simplest form a repeater is a digital amplifier: it receives a stream of ones and zeroes on one port and retransmits the stream out another port after boosting the signal strength. Repeaters are active, powered devices.
	Unless otherwise noted, all of the examples in this section are Ethernet / 802.3. Token-Ring, FDDI, and ARCNET repeaters are available; it is simply clearer and more convenient to stick to one technology in the text.		A repeater can be used to connect two maximum-length segments to form one larger segment. For example, two 175m 10Base2 segments cannot be joined together directly. Their collective length of 350m exceeds 10Base2's 182m maximum segment length. The segments can, however, be joined by a repeater. The repeater's signal amplification overcomes the 182m distance limit. Repeaters are layer one devices -- they interact with the network media on the Physical layer. As such they have no concept of frames; just streams of bits whose strength they amplify and pass on. Every bit that reaches the repeater will be sent back out. Repeaters can have two ports, or many. A 10Base-T hub is a multiport repeater; commercial hubs come in up to 48 port configurations. If an Ethernet network includes a repeater, the repeater will pass on good traffic and collisions: the repeated segment is one collision domain. As a layer one device the repeater has no concept of the overlying channel access method. As good they sound, repeaters cannot be used to extend network indefinitely. Three limitations will come into play as the network is repeated over longer and longer distances. With more cable, you can add more stations. With more stations there is more traffic. Eventually, the network will become saturated with traffic. Extending the network further at this point won't make things better, it will make them worse. (This is where bridging comes in handy.) The speed of signal propogation over the network is finite: as the network grows larger the time for a signal to travel from one end to the other also grows. By adding more and more repeaters, the network will grow to a size where it takes too long for traffic to propogate from end-to-end for the network's layer two channel access method to function properly. ARCNET, for example, reaches this point when the end-to-end propogation time exceeds 31 microseconds. To grow larger at this point, the network needs to be divided up into separate segments with a bridge or router. As the number of repeaters increases, the likelihood that the stream of data will become corrupted increases. Adding more cable and repeaters to a network is like adding more people to a game of "telephone": the more people there are in the game the more likely it is that the message that went in will not be the message that comes out!
			The 5-4-3 Rule Ethernet and IEEE 802.3 implement a rule for the number of repeaters and segments on the network. The rule, known as the "5-4-3 Rule" is designed to keep Ethernet networks small enough so that they do not encounter the three problems explained above.
	An important distinction is in play here: segment is being used two ways here. Physical segments are lengths of cable joined by repeaters, logical segments are whole collision domains. When we discuss routers we will introduce yet another wrinkle into what "segment" means!		The 5-4-3 rule divides the network into two types of physical segments: populated (user) segments, and unpopulated (link) segments. User segments have users' systems connected to them. Link segments are used to connect the network's repeaters together. The 5-4-3 rule states that an Ethernet network shall be made up of no more than five segments, connected by no more than four repeaters, and only three of the five segments may contain user connections. The Rule was created when Ethernet, 10Base5, and 10Base2 were the types of Ethnernet network available. In the present day the question is, how does the 5-4-3 rule apply to 10BaseT and 100BaseTX? Both of these technologies use hubs -- which are simply multiport repeaters -- to connect all of the stations of the network together. The answer is unclear. I have chained up to seven Ethernet hubs together with no perceptible degradation in network performance. And, I have not been able to locate a hard and fast rule in the literature. A prudent and conservative approach would be to limit the number of 10BaseT and 100BaseTX hubs chained together to four -- the 4 in the 5-4-3 rule.
	On many hubs with a switchable uplink port the switch is labled "MDI" or "MDI-X". MDI stands for Medium Dependant Interface. The "X" indicates whether the connection has a crossover wired into it. Station ports have a crossover built in. Uplink ports do not. So, to switch a port from station to uplink, place the switch in the "MDI" position.		Stackable Hubs Port-count for 10BaseT and 100BaseTX hubs runs from 4, 8, and 12 ports in small hubs, to 16, 24 and even 48 for larger hubs. Most hubs have a special port called an uplink port for connecting to another hub. In some cases this port is separate from the regular station ports, in others this port is controlled by a switch and can either act like a station port or an uplink port. When you connect two Ethernet hubs, you use a station port on one hub, and the uplink port on the other hub. This permits you to daisy-chain hubs together so that you can connect more users to the same segment. Hubs with fiber-optic (10BaseFL or 100BaseFX) uplinks permit you to connect users on different floors or in different buildings to the same network. The limitations of repeated networks presented a question to Ethernet hardware manufacturers. How do you achieve higher port-counts without adding more repeaters to the network? Essentially, there are two answers. The first is to build a larger hub. Concentrator is the term generally applied to the largest hubs. Concentrators have very high port counts (sometimes in the hundreds) and usually have other high-end features such as network management and redundant power supplies. Concentrators are a good answer for very large networks, but their high capacity and rich features comes at a high cost. The second answer permits a more incremental approach to achieving high port-count. The graphic above shows two methods for connecting hubs. On the left is a simple daisy-chain where the hubs are connected to each other through their uplink ports. These three hubs count as three repeaters under the 5-4-3 rule. On the right is a unit made up of stackable hubs. Each hub has one or more special connections designed to link it to another hub, and to cause both hubs to operate as if they were one unit. The three hubs in the hub stack on the right function as if they were one large hub, and count as only one repeater under the 5-4-3 rule. Stackable hubs enable you to start out small and grow as your needs increase. You buy only what you need, when you need it. If you desire you can add network management functions as the network grows. Be aware that stackable hubs from one manufacturer generally will not stack with hubs from another manufacturer. Also, you may discover incompatibilities between different families from one manufacturer. For example, Bay Networks 2800 series hubs cannot be used in the same stack with Bay Networks BayStack hubs: they can still be connected using their uplink ports.
			[ II ] BRIDGES Bridges inhabit the next tier up in the OSI Model -- the Data Link layer. As Layer 2 devices, they manipulate data as frames and fully participate in the network's channel access method. Bridges provide the same functionality as repeaters in terms of extending segment lengths and overcoming station-count limitations. This is secondary to a bridge's primary function. Bridges filter traffic passing between segments. When implemented correctly, this increases the maximum throughput of the network as a whole. Bridges only work up to the Data Link layer -- they are not aware of Network layer protocols, and are not affected by anything going on in the upper layers. Bridges are network protocol independant. Traffic filtering is the ability of the bridge to forward only those frames of data that are destined to addresses on other segments. A bridge makes filtering / forwarding decisions based on examining the Layer 2 destination address in each frame and checking it against a forwarding table. Stations on the network address frames directly to their destination, not the bridge. The stations are not aware that a bridge is operating on the network. Because of this, we refer to bridges as being transparent. Transparent (Learning) Bridges Transparent bridges are defined by the IEEE 802.1D standard. The graphic below shows a transparent bridge in action. Station B sends out a frame, the destination address is station C, the source is B, and the rest of the frame is upper layer data. The bridge (B1) sees the frame as it is propogating down segment S1. It looks in its forwarding table to see if station C is on segment S1 or S2. Station C is on S2, so the bridge forwards the frame to segment S2 where C receives the frame. If station C were on segment S1, then the bridge would have ignored the frame after checking C's location in its forwarding table. The crucial thing to remember is that the frames are addressed to their destination, not to the bridge! IEEE 802.1D transparent bridges are learning bridges. When a bridge is first powered up its forwarding table is empty. It learns the location of each station on the network by listening to network traffic. By default, if a bridge does not know where a station is located it automatically forwards frames addressed to that station. Thus, when a transparent bridge is first turned on it forwards all the fames that are transmitted on the network. The learning process is usually completed fairly quickly; in a short time the bridge knows which segment each station is on, and only forwards frames that need to be forwarded. Frames addressed to broadcast and multicast addresses will always be forwarded. Use the diagram above as a reference in reading the following section. The steps below show how the bridge in the diagram learns the location of different stations on the network. The bridge (B1) has just been powered up; its forwarding table is empty: Segment Stations S1 ~ S2 ~ S3 ~ Station G sends a frame addressed to station A. The bridge forwards the frame. It now knows: Segment Stations S1 ~ S2 ~ S3 G B sends a frame addressed to D. The bridge forwards the frame and learns: Segment Stations S1 B S2 ~ S3 G A replies to G's frame. The bridge knows where G is and forwards the frame. Its table now has: Segment Stations S1 A, B S2 ~ S3 G E sends a frame to F. The bridge still hasn't learned where F is, so it forwards the frame... Segment Stations S1 A, B S2 ~ S3 E, G F replies to E's frame. The bridge looks up E in its table, and concludes that it does not need to forward the frame. With F's transmission the bridge's forwarding table now contains: Segment Stations S1 A, B S2 ~ S3 E, F, G D finally replies to B's frame. The bridge looks up B in its table, and forwards the frame. Now D is in the bridge's forwarding table. The bridge still hasn't learned C's location yet, but it will the first time C sends a frame. Segment Stations S1 A, B S2 D S3 E, F, G Because 802.1D bridges learn about their environment on the fly, they require almost no setup on the part of the network administrator. This "plug and play" characteristic makes bridges a very attractive tool for partitioning networks to gain greater throughput. Because transparent bridging is very simple, bridges also tend to be relatively inexpensive pieces of equipment. The performance benefits of bridging are addressed fully in the 80/20 Rule section below. Transparent bridges operate using a store and forward methodology. The bridge makes a copy in its memory of each frame that is sent over the network. It decodes the Layer 2 header and reads the destination and source addresses. It updates its table from the source address, if necessary. Then it looks up the destination address in its forwarding table and makes the forward/no forward decision. If it decides that it should forward the frame, the bridge computes a CRC on the frame and compares it with the stored CRC. If they match the bridge will go ahead and forward the frame. If they don't, the bridge knows that the frame is corrupted, and it drops the frame: the bridge won't knowingly forward junk! As the bridge attempts to forward a frame it may have to wait for its turn to transmit, depending on the what is happening on the destination segment, and the CAM in use on the network. All of the steps above take time, not much time but a measurable amount. The delay incurred while the bridge processes the frame is called latency. A bridge that does not have enough memory to buffer all of the network traffic that is coming by it, or is otherwise congested may cause excessive latency in the netwok, degrading application perfomance and hampering overall network throughput. The table below summarizes the criteria tranparent bridges use to determine when, and when not, to forward a frame: Frames are forwarded if they: Are destined to a remote segment Contain user data Have a valid CRC or FCS Are not addressed to the bridge Frames are not forwarded if they: Are destined for a local segment Contain MAC management information Fail CRC or FCS checking Are addressed to the bridge
	A popular form of transparent bridge is the Layer 2 Switch. Layer 2 Switches are high-speed, multiport bridges. L2 switches often perform speed matching. They are discussed fully in Chapter Ten.		Because transparent bridges use a store and forward method of operation, they can perform speed matching. A transparent bridge can be used to forward traffic between a Token-Ring running at 4Mbps and a ring running at 16Mbps, or between a 10BaseT segment and a 100BaseTX segment. Source-Route Bridges IBM has specified a different bridging methodology called Source Routing. Source routing bridges do not develop and maintain forwarding tables; they rely on routing information included in each frame of data to determine if and how to forward a frame. Source routing depends on each station developing its own table of bridging information. Source route bridging is still bridging -- it operates only on Layer 2 like IEEE transparent bridging -- and should not be confused with Routing, which takes place on Layer 3 using Network layer protocols.
	Source Routing is thoroughly overdesigned and overly complex when compared to transparent bridging. This, however, seems like a perfectly "IBM" thing to do.		Stations on a source routing network learn where their peers are in the network by sending out discovery packets. Each source routing bridge that handles the discovery packet on its way from source to destination will insert its ID in the packet. When the destination sends the discovery packet back to the source, the source will have a route mapped out through the network's bridges from itself to the destination. It will file this for future use. Conversley, when the destination received the discovery packet it learned a route to the source of the packet. Once discovery has been completed, the source station can send frames to the destination by encoding the path it discovered into the frame's header. The bridges on the route will forward the frame based on the header's instructions. This mechanism generates a fair amount of traffic from stations that are starting up and are learning the layout of the network. To limit some of the route discovery traffic, a station will try to find its peers on its local ring first before sending out discovery packets that will be bridged acrosss the network. Manufacturers have developed a hybrid Source Routing / Transparent bridge. This bridge treats frames with source routing information in them according to source routing rules; it treats all other frames under the transparent bridging rules. This hybrid device permits networks to mix systems which require source routing with systems that do not understand the source routing protocol.
			The 80/20 Rule The 80/20 rule is a guideline for setting up bridged networks. The 80/20 rule says that you should position a bridge so that 80% of the traffic on a segment is local traffic, and only 20% is traffic that must be forwarded. This rule isn't designed to make sure that the bridge has an easy job, rather it is designed with network performance in mind. When a bridge is not forwarding traffic from one segment to another, the two (or more) segments can operate independantly. Each can carry a "conversation" between the stations on that segment. This has the effect of multiplying the network's aggregate throughput. For example, if we have two 16Mbps Token-Rings connected by a bridge and the stations on each ring are sending frames only to each other (not to stations on the other ring), then the maximum throughput of the network as a whole is 32Mbps (16Mbps x 2 rings). As soon as a station sends a frame that must be forwarded from one ring to the other, aggregate throughput drops as both rings are now carrying the same conversation. If a bridge is placed correctly in relation to the resources and users on the network, it can create that throughput multiplying effect much of the time. In the network depicted below there are two servers. If the primary users of the server on the left are located on the left-hand segment, then their traffic will stay on that segment. Only when they need to access a resource (such as a file or printer) on the right-hand server will their traffic have to cross the bridge. A real life example would be to have the accounting department and their server on the red segment, and the graphic design department and their server on the blue segment. Both primarilly use the resources of their own server, but sometimes each needs the resources on the other's server. This design meets the 80/20 rule and will maximize the bridge's performance boosting effect. If all of the users were on one side of the bridge and the servers on the other, the bridge would do nothing to increase network performance. In fact, because it would be bridging all of the traffic on the network, it would make network performance somewhat worse due to the small latency inherent in bridge operation. The graph below shows a theoretical comparison of throughput between a network connected with repeaters, and one with well placed bridges.
	Network equipment being both critical and governed by Murphy's Law will almost always fail at the worst time. Such as at two AM when you're trying to sleep, or a six PM on Sunday when you're just sitting down to dinner with the family. Building fault tolerance into the network, in the form of redundant components, isn't just a good business idea, it's a key to keeping your sanity.		Spanning Tree Algorithm Bridges, because they are choke-points through which all segment-to-segment traffic must pass, represent a critical point of failure. A bridge that has crashed or otherwise failed could effectively break a network in two. To address this vulnerability, network designers will implement redundant bridges between segments. With two bridges connecting segments together one bridge can fail and the other will take over the load. Network operation is not affected, and you can replace or repair the failed bridge when it is convenient. Without some extra programming, a pair of simple transparent bridges will almost instantly run into a fatal problem when connected redundantly. The problem is known as a bridging loop. I'm not sure if some bright network enginners figured out the potential for this problem before they connected the first pair of redundant bridges. If they didn't forsee the problem beforehand, they discovered it very quickly after they flipped the power switch on the second bridge. The diagram below shows a bridging loop in full swing. The explanation of how the loop starts (beneith the diagram) uses the diagram as its example. A bridging loop starts very simply, and it's due to the bridges' learning behavior. When the bridges are powered up, their forwarding tables are empty. They start trying to learn the layout of the network as they are programmed to do. The trouble starts when the first station on the network sends a frame: Station I on Segment S1 sends out a frame addressed to station II: the frame propgates down the network wire in the usual way... B1 sees the frame first; it doesn't know where B is, so it automatically forwards the frame. It notes that I is on S1 B2 sees the frame second, and does exactly what B1 did. Both bridges have now forwarded copies of station I's frame onto segment S2. B2 sees the copy of the frame the B1 just forwarded on S2 and takes it in. It now thinks that station I has moved to S2, adjusts its tables, and because it still doesn't know where II is, forwards the frame. B1 sees the copy of the frame that B2 forwarded onto S2 in step 3. It does exactly what B2 did in step 4. Now both bridges have forwarded a copy of the frame from S2 to S1. Both bridges see the copies that the other bridge forwarded from S2 onto S1. Both forward the other bridge's frame back onto S2 because they still don't know where the destination, station II, is located. Station II may be having problems of its own at this point as it is continuously receiving copies of the same frame! Once started this loop will go on endlessly. Every frame added to the network by the stations will only add to the churning mess of continuously forwarded frames. To say that the network will grind to a halt is really untrue: because the bridging loop starts with the first packet transmitted, the network never has a chance to "get going" in the first place! The IEEE 802.1D standard which defines transparent bridges also contains a remedy for bridging loops, the spanning tree protocol. Spanning Tree is a method for selecting which bridges in a redundant bridge network will forward frames, and which will sit on the sidelines waiting for the need to step in as a replacement. Which bridges will actively forward frames, and which will standby as replacements is determined by a pair of selection processes. The first process determines which bridge is the root bridge, and which is the standby root bridge. The root brige has special responsibilities, which I will cover below. Once the identity of the root bridge has been determined the second selection process determines which bridges will forward traffic and which will sit in blocking mode, waiting for the need to step in. These processes use a special packet called a Bridge Protocol Data Unit (BPDU) to communicate from bridge to bridge. The steps below use the following graphic to illustrate both selection processes, starting when the bridges are first powered up, and before any user traffic is forwarded. A note first: bridges B3 and B4 both connect segements S1 and S2; bridges B1 and B2 both connect S2 to S3; bridges B5 and B6 both connect S3 to S4. Without spanning tree this is a recipie for bridging loop flambe. Root bridge selection is first. Each bridge broadcasts BPDUs on both its ports which contain its bridge ID number. When a bridge sees a BPDU with a lower bridge ID it stops sending out its own bridge ID and starts sending out BPDUs with the lower ID. After a certain period of time, all the bridges will be sending out BPDUs with the ID of the bridge with the lowest ID. That bridge becomes the root bridge. In this case, it is B1 with an ID of 1000. B1 knows that it is the root bridge because at the end of the selection process it was receiving BPDUs from other bridges with its own bridge ID in them. B2 (ID 1010) knows that it is the backup root bridge because it initially received BPDUs with B1's ID on both of its ports. The other bridges designate their ports that face toward the root bridge as their "root" ports. They will not send out BPDUs on their root ports, execpt on one special case, after root bridge selection is done. Now the forwarding selection process begins. Each bridge will start sending out BPDUs with their port cost (PC). These BPDUs will only be sent out on ports facing away from the root bridge (they will be sent out on each bridge's non-root port). when a bridge receives a BPDU on its root port, it adds the port cost contained in that BPDU to its own, and sends it on. When a bridge sees a BPDU on its non-root port with a lower port cost than its own it starts sending out BDUs with the lower port cost. Because it now knows that a bridge with a lower port cost is on the network it will not forward user frames: the bridge with the lower port cost will. In the graphic above, B3, B1, and B5 will forward frames. B4, B2, and B6 will block. After the time for the forwarding selection process ends the bridge with the lower port cost will begin forwarding frames. Frame forwarding starts after the second selection process ends. Both processes are limited by a time value (usually several seconds). Once forwarding starts it will continue until some event occurs which requires adjusting the bridges' configurations. The blocking bridges (B4, B2, and B6 above) do not just sit idly by. They spend their time listening for periodic BPDUs from the bridges engaged in forwarding. For example: Periodically B3 will send out a BDPU on its non-root port (a bridge's root port is its port which faces toward the root bridge). This BPDU essentially says "I'm alive!". B4 keeps track of the BPDUs from B3. If it does not receive one within a predetermined length of time, it assumes that B3 has suffered some sort of failure and is no longer able to forward frames. When this event occurs, the listening bridge will send out BPDUs called Topology Change Notifications (TCNs) on its root port (this is the special exception to a bridge not sending out BPDUs on its root port!). The other bridges on the network will forward the TCN toward the root bridge, and acknowledge the TCN back to its sender. In our example, B4 on detecting that B3 is down, will send out a TCN onto segment S2. B1, the root bridge, will receive the TCN immediately. On a larger network the TCN might have to pass through several bridges before reaching the root bridge. Upon reciept of a TCN the root bridge sends out a BPDU with the Topology Change Flag (TCF) set. All bridges receive the BPDU with TCF set and all stop forwarding user traffic immediately. The bridges will wait for a period of time specified by the root bridge, and then they will start the second (forwarding) selection process over again. In our example, baucuse B3 has failed, B4 will vie for the forwarding job between segements S1 and S2 unopposed. After the selection process ends, the forwarding bridges will be B4, B1, and B5. B2 and B6 will be blocking. If the root bridge should fail, the backup root bridge will send out BPDUs to start the entire selection process over again, leading to selection of a new root bridge and new forwarding bridges. The bridge IDs, port costs, and post-TCF wait time are all values set by the network administrator. You should carefully select the root bridge based on which one is closest to the logical "center" of the network. The wait time between notification of a topology change and commencement of the forwarding selection process should be long enough to guarantee that all bridges on the network have received it. Be aware that bridges listen for BPDUs on a bridge management address. This address is selected by the bridge manufacturer. Before attempting to mix bridges from different companies, you should verify what bridge management address they use, and whether this can be changed so that all of the bridges listen to the same address. WAN Bridges WAN Bridges, or Remote Bridges can be used to connect network segments over a Wide Area Network. While this is attractive due to the lower cost of bridges vs. routers, connecting LANs over a WAN is a job much better performed by a router. Because they are transparent, bridges effectively hide the existence of the slower WAN connection. This can cause problems with upper layer applications that are not aware that a slow link exists. Routers, which make such connections visible on the network are a much better choice in the role.
			[ III ] CONCLUSION Chapter four started our survey of internetworking devices. We have covered repeaters and bridges. Repeaters are Physical layer devices whose role on the network is to permit longer segment lengths with more devices. Bridges are Data Link layer devices whose role is to partition the network to achieve greater overall network throughput. Bridges are Network layer protocol independant. When placed according to the 80/20 rule a bridge can substantially increase total network bandwidth. Bridges are best suited for LANs; routers are a better choice in MAN and WAN environments.
			[ IV ] SELF CHECK What is the minimum number of ports a repeater must have? What is the maximum? Can a repeater be used to connect networks with different data rates? What tool would you use to connect two networks with different data rates? Two bridges at the edge of a network are competing for the job of forwarding user frames. One has a port cost of 12, the other 15. Both are receiving BPDUs on the root ports with advertising a port cost of 6. Which one will get the job of forwarding? How many segments can contain user stations under Ethernet's 5-4-3 rule? How does a bridging loop start? What does the spanning tree protocol do to prevent bridging loops? A bridge sees a packet with a destination address which it knows is on another segment. As it prepares to forward the frame it discovers that the frame has been corrupted in transmission (the CRC check fails). What does the bridge do with the frame? A bridge has just been rebooted. What is the condition of its forwarding table? The bridge from the question above sees a frame on one of its network interfaces. The frame is to station Z from station L. What does the bridge learn from this frame, and what does it do with the frame? Can a bridge always forward a frame immediately?
			[ CH 3 ] [ TOC ] [ CH 5 ] 1999,2000 Shipman | Created 2-7-99 | Updated 2-6-00