Ethernet
Troubleshooting - Physical Frame Corruption
Introduction
When
troubleshooting your Ethernet network, the first thing
to look for is physical frame corruption. In this essay,
we will discuss the different causes of physical frame
corruption and the characteristics of each one. It is
important to remember that the frame corruption being
discussed is SPECIFIC TO COAXIAL ETHERNET. Twisted-pair
Ethernet implementation will NOT manifest these types of
corruption patterns!
Let's find the problem !
I am going
to discusses troubleshooting with reference to the
Network General Expert Sniffer Network Analyzer. While
the tips here are universal, other Analyzers' behavior
might differ in such a way as to make these tips invalid
or unusable.
There are
four possible causes of physical frame corruption in an
Ethernet Network, each one different in the way it
corrupts the frame and therefore recognizable.
The four
causes are:
-
Collisions. Caused by
out of spec. cabling or faulty hardware.
-
Signal Reflections.
Caused by un-terminated cables, impedance mismatch
and exceeding the maximum allowable bend radius of
the cable.
-
Electrical Noise.
Caused by nearby power grids, fluorescent lighting,
X-ray machines, etc...
-
Malfunctioning Hardware.
Caused by gremlins, helpful users, natural
disasters, etc...
At the end
of the section there is a troubleshooting flowchart to
help you identify the cause of frame corruption. It is
important to remember that these corruption patterns
will only be evident on a coaxial Ethernet (10BASE-2
Thin Ethernet, 10BASE-5 Thick Ethernet). Twisted-Pair
Ethernet networks, where each station is connected to a
hub or switch, do not manifest these exact corruption
patterns.
Collisions
Collisions
are the most easily recognizable of the four causes of
physical frame corruption. Generally, when a collision
occurs, several bytes of the preamble of the colliding
frame will be read into your Sniffer's buffer before the
signal is completely destroyed. You will see these bytes
in the hexadecimal decode of the packet as either
several bytes of AAs or several bytes of 55s at the very
end of the frame (Remember, AAh=1010b, 55h=0101b.
Depending on where the collision occurred, the preamble
could be perceived as either of these).
Because the
preamble is only 8 bytes long, ending in 1011, if you
see more than 8 bytes of AA or 55, then the corruption
was not caused by a collision and more investigation is
necessary.
Signal Reflections
Signal
reflections are caused by electrons literally "bouncing"
back along the wire. One cause of signal reflection is
an un-terminated cable. Electrons travel down the wire
until they reach the cable's end where, with no resistor
to absorb the voltage potential, they reflect back from
the open end of the cable.
Another
cause of signal reflections is mixing cables with
different impedances. Impedance can be thought of as the
"rate of flow" of the wire. When electrons from the
higher impedance wire attempt to travel through the
lower impedance wire, some of them can't make it and are
reflected back, destroying the signal.
The final
cause of signal reflections is when the maximum
allowable bend radius of the cable is exceeded - the
copper media is deformed, causing reflections.
The
characteristic of signal reflection is very short frames
(typically less than 16-32 bytes), with no preamble in
the frame and with all frames cut short within one or
two bytes of the same place in the frame. Once again,
this can be determined by viewing the frames in the
Hexadecimal Decode view of your analyzer. The Expert
Sniffer will also probably detect a high number of short
or runt frames, as well as a high rate of physical frame
corruption.
Electrical Noise
Physical
frame corruption caused by electrical noise is similar
in appearance to corruption caused by reflections in
that there is no preamble in the frame -- the frame just
seems to stop short, but it is different in that the
frames are generally cut off at random lengths.
Hardware Malfunctions
Frame
corruption caused by hardware malfunctions is
potentially the hardest to diagnose because of the large
number of ways that hardware can malfunction. Generally,
hardware malfunctions will occur either randomly or
constantly, but not regularly. The type of frame
corruption is impossible to predict, generally
manifesting as random "garbage" in the frame, but some
common signs are:
-
A stream of ones or zeros.
A transceiver has malfunctioned and is "jabbering"
on the wire. Most transceivers have jabber detection
circuitry that prevents the adapter from
transmitting for longer than a certain preset time.
-
Gigantic frames
(greater than 1500 bytes). Same as above.
Troubleshooting Flowchart
REMEMBER: This applies to
corruption patterns that would be visible when viewing
frames on a COAXIAL Ethernet.
1. Is a preamble (less than 8 bytes of AA or 55) visible
at the very end of the frame?
If yes:
- Make
sure you haven't exceeded the specifications of your
cable (maximum cable length, maximum repeaters in
between nodes, etc)
- Use a
"divide and conquer" method to isolate the
troublemakers. Separate the network into halves
using a bridge and see which side of the bridge the
problems occur on. Now separate that half into
halves, etc....
If no, go
on.
2. Are the corrupt frames very short, and consistently
the same length?
If yes:
- Your
problem is probably related to signal reflection.
First check for un-terminated cables. If the cable
is terminated properly, your job becomes a lot
harder. If new cable has been installed recently,
impedance mismatch is probably the problem. Avoid
this problem by buying all your cabling from the
same lot
(if possible) and buying cabling all at once and
putting extra in storage rather than ordering as
needed. Finally, check for cable deformation due to
bending the cable or placing heavy objects on the
cable.
- A Time
Domain Reflectometer can really save you some work
when diagnosing this type of problem. This device
can tell you, probably to the foot, how far down the
wire the signal reflection is occurring.
If no, go
on.
3. Are the frames random in length, all cut off cleanly
with no signs of bit streaming or other hardware
malfunction?
If yes:
- Your
problem is probably electrical noise. Use the
"divide and conquer" method outlined in bullet
number 1 to determine where the noise is occurring
and then use your intuition. I've seen problems as
bizarre as a dentist's X-ray machine being on the
other side of the wall to the wiring closet and
every time the dentist took an X-ray the network
would go down!
If no, go
on.
4. If you've arrived at
this point, your problem is probably hardware related.
Use the "divide and conquer" method outlined in
bullet
1. |
