Jeff Duntemanns Drive-By Wi-Fi Guide

A network switch is much more than a hub. It has some considerable intelligence built into it, most of which is devoted to determining what devices are on its network and what their addresses are. In a hub network, only the computers need to pay attention to the addresses attached to packets. In a switched network, this burden is moved to the center and placed on the switch.

A switch contains a number of switchable connection points called ports. (Most switches used in home office networks have four or perhaps eight ports. Switches for large corporate networks can have a great many more, sometimes hundreds.) One computer or other networked device (like network printers and other networkable gadgets) can be attached to each port.

Each port must be associated with a unique network address. The switch keeps a table inside itself, relating a network address to a switch port. When a packet arrives at the switch, the switch looks at the packet's destination address, looks up that address in its port table, and then creates the connection between the port belonging to the sender of the packet and the port belonging to the packet's intended recipient.

The switch has several tricks that it uses to build and maintain its internal table of network addresses, but most commonly, a computer will broadcast its network address over the network when it powers up or reboots. The switch sees this broadcast and records the address.

Network switches are common, small, and inexpensive. Most of the switches I've used in home networks in the past were from Linksys, like the 5-port EZXS55W model shown in Figure 2.5.

Figure 2.5: A 5-Port Switch for Home Networks. (Photo courtesy of Linksys.)

Don't run out and buy one yet-simple switches like this lack critical machinery for dealing with the Internet, as I'll explain in Chapter 3. Only when your home network is completely disconnected from the Internet does a dedicated network switch make sense, and such networks are getting rarer all the time.

Media Access Control (MAC) Addresses

The nature of network addresses is worth some discussion, because they come up now and then in Wi-Fi work, and in certain cases you'll be called upon to determine the addresses of some of your network gear. The network addresses used in Ethernet networks are formally called media access control ( MAC) addresses. The term comes from the network machinery that controls what devices get access to the network medium, which if you recall is the generic term for whatever carries packets from one device to another. It can be cable, glass fiber, or microwaves, but it's still a medium, and access to the medium has to be managed in an orderly fashion.

Any device or part of a device that represents an interface to an Ethernet medium has a MAC address. Your computer's network interface controller (NIC) has a MAC address. Your Wi-Fi client adapters each have a MAC address. Some devices have more than one MAC address, because they contain more than one Ethernet interface.

The best example is the wireless residential gateway, which I'll describe in detail in Chapter 6. A wireless residential gateway acts as a communications center to which a wired network, a wireless network, and the Internet are all connected at once. There is a separate MAC address for the wireless interface, a MAC address for the Ethernet cable interface, and yet a third for the Internet interface.

Theoretically, every MAC address ever issued is unique. No other device ever made in the past (and if the rules be followed, ever made in the future) will carry that same exact address. If more than one device with the same MAC address were to show up on a single network, packets could go to the wrong destinations, and network switches could become very confused. Nothing's perfect, and there have been duplicate MAC addresses issued through error or carelessness, but it happens rarely enough as not to be a major problem.

A MAC address is a number, usually expressed in hexadecimal, which is base 16 rather than our familiar base 10. In hexadecimal, values from 10 through 15 must be represented as single digits, so the letters A through F are used to represent values from 10 to 15, respectively. This is why a MAC address may look like this:

0080C8ADAC0B

What looks like letters are actually used as numbers in hexadecimal notation. Each pair of hexadecimal digits represents one byte, and each byte contains eight bits. The full number thus contains 48 bits, and 48 binary bits are capable of expressing 281,474,976,710,656 different values. In other words, 281 trillion values and change- that's a lot of network interface controllers, so we're not going to run out of MAC addresses any time soon.

Each MAC address is divided into two groups of three bytes. The first three bytes are a manufacturer code. The last three bytes contain a serial number of devices built by that manufacturer. This manufacturer code can be misleading, because manufacturers often build subsystems and then sell them to other companies who build them into final products. You won't necessarily see the company name that 'owns' your MAC address on the gear the MAC address belongs to.

For example, the 24-bit hexadecimal value 00022D is the manufacturer code for Lucent/Agere, the originator of the Orinoco line of Wi-Fi client adapters and access points. The value 004096 is the code for Aironet Wireless Communications, which is now owned by Cisco. A full MAC address for a single Orinoco Wi-Fi PC card might look like this:

00022D-6749A4

The hyphen is a frequent notational convention, and separates the 24-bit manufacturer code from the 24-bit device identifier. A lot of MAC address blocks are assigned to faceless Pacific Rim conglomerates whose names don't go on the box. 24 bits allows a manufacturer to make over 16 million different devices, each with a unique address. That's actually not an impossible number of circuit boards for one manufacturer to stamp out, but there's nothing to prevent a manufacturer having more than one block of addresses. Xerox Corporation, in fact, has thirteen blocks, including the first nine.

MAC address blocks are assigned by the Institute of Electrical and Electronic Engineers (IEEE) as part of their standards programs. A complete list of what manufacturers have what MAC manufacturer codes can be found at the following Web site. As you might imagine, it's immense: http://standards.ieee.org/regauth/oui/oui.txt

If you look on the underside of your Wi-Fi gear you'll often find its MAC address printed right on it, sometimes on a sticker, often next to a bar code. The MAC address of a piece of Wi-Fi gear is almost always displayed somewhere on the configuration utility belonging to that piece of gear, and if it's not printed on the device somewhere that's the first place you should look. Figure 2.6 shows the back of a Cisco Aironet 342 PCMCIA card. Look at the bottom of the card and you'll see a line beginning 'MAC ID:' The number that follows is the card's MAC address.

Figure 2.6: A MAC Address Label.

Privacy paranoids need to understand that no effort is made to associate a device's MAC address with the person who owns it, but be aware that barring some clerical screw up, no other device anywhere in the world carries the same address. Your Internet IP address may change each time you dial in to the Internet, but your Mac address changes only when you swap in new network hardware. And each time you connect to an Ethernet network, your Wi-Fi client adapter proudly announces your MAC address to the entire network-which is something to meditate on if you ever find yourself thinking about 'liberating' bandwidth from an unprotected Wi-Fi network.