While switches may learn about topologies at many layers, and forward at one or more layers, they do tend to have common features. Other than for high-performance applications, modern commercial switches use primarily Ethernet interfaces, which can have different input and output speeds of 10, 100, 1000 or 10,000 megabits per second. Switch ports almost always default to Full duplex operation, unless there is a requirement for interoperability with devices that are strictly Half duplex. Half duplex means that the device can only send or receive at any given time, whereas Full duplex can send and receive at the same time.
At any layer, a modern switch may implement power over Ethernet (PoE), which avoids the need for attached devices, such as an IP telephone or wireless access point, to have a separate power supply. Since switches can have redundant power circuits connected to uninterruptible, the connected device can continue operating even when regular office power fails.
Hubs versus higher-layer switches
Layer-1
A network hub, or repeater, is a fairly unsophisticated network device. Hubs do not manage any of the traffic that comes through them. Any packet entering a port is broadcast out or “repeated” on every other port, except for the port of entry. Since every packet is repeated on every other port, packet collisions result, which slows down the network.
There are specialized applications where a hub can be useful, such as copying traffic to multiple network sensors. High end switches have a feature which does the same thing called port mirroring. There is no longer any significant price difference between a hub and a low-end switch.
Layer 2
A network bridge, operating at the Media Access Control (MAC) sub-layer of the data link layer, may interconnect a small number of devices in a home or office. This is a trivial case of bridging, in which the bridge learns the MAC address of each connected device. Single bridges also can provide extremely high performance in specialized applications such as storage area networks.
Classic bridges may also interconnect using a spanning tree protocol that disables links so that the resulting local area network is a tree without loops. In contrast to routers, spanning tree bridges must have topologies with only one active path between two points. The older IEEE 802.1D spanning tree protocol could be quite slow, with forwarding stopping for 30 seconds while the spanning tree would re-converge. A Rapid Spanning Tree Protocol was introduced as IEEE 802.1w, but the newest edition of IEEE 802.1D-2004, adopts the 802.1w extensions as the base standard. The IETF is specifying the TRILL protocol, which is the application of link-state routing technology to the layer-2 bridging problem. Devices which implement TRILL, called Routing Bridges, combine the best features of both routers and bridges.
While “layer 2 switch” remains more of a marketing term than a technical term, the products that were introduced as “switches” tended to use micro segmentation and Full duplex to prevent collisions among devices connected to Ethernets. By using an internal forwarding plane much faster than any interface, they give the impression of simultaneous paths among multiple devices.
Once a bridge learns the topology through a spanning tree protocol, it forwards data link layer frames using a layer 2 forwarding method. There are four forwarding methods a bridge can use, of which the second through fourth method were performance-increasing methods when used on “switch” products with the same input and output port speeds:
Store and forward – The switch buffers and, typically, performs a checksum on each frame before forwarding it on.
Cut through – The switch reads only up to the frame’s hardware address before starting to forward it. There is no error checking with this method.
Fragment free – A method that attempts to retain the benefits of both “store and forward” and “cut through”. Fragment free checks the first 64 bytes of the frame, where addressing information is stored. According to Ethernet specifications, collisions should be detected during the first 64 bytes of the frame, so frames that are in error because of a collision will not be forwarded. This way the frame will always reach its intended destination. Error checking of the actual data in the packet is left for the end device in Layer 3 or Layer 4 (OSI), typically a router.
Adaptive switching – A method of automatically switching between the other three modes.
Cut-through switches have to fall back to store and forward if the outgoing port is busy at the time the packet arrives. While there are specialized applications, such as storage area networks, where the input and output interfaces are the same speed, this is rarely the case in general LAN applications. In LANs, a switch used for end user access typically concentrates lower speed (e.g., 10/100 Mbit/s) into a higher speed (at least 1 Gbit/s). Alternatively, a switch that provides access to server ports usually connects to them at a much higher speed than is used by end user devices.
Layer 3
Within the confines of the Ethernet physical layer, a layer 3 switch can perform some or all of the functions normally performed by a router. A true router is able to forward traffic from one type of network connection (e.g., T1, DSL) to another (e.g., Ethernet, Wi-Fi).
The most common layer-3 capability is awareness of IP multicast. With this awareness, a layer-3 switch can increase efficiency by delivering the traffic of a multicast group only to ports where the attached device has signalled that it wants to listen to that group. If a switch is not aware of multicasting and broadcasting, frames are also forwarded on all ports of each broadcast domain, but in the case of IP multicast this causes inefficient use of bandwidth. To work around this problem some switches implement IGMP snooping.
Layer 4
While the exact meaning of the term Layer-4 switch is vendor-dependent, it almost always starts with a capability for network address translation, but then adds some type of load distribution based on TCP sessions.
The device may include a state full firewall, a VPN concentrator, or be an IPSec security gateway.
Layer 7
Layer 7 switches may distribute loads based on URL or by some installation-specific technique to recognize application-level transactions. A Layer-7 switch may include a web cache and participate in a content delivery network.
Types of switches
Form factor
Switchport
Desktop, not mounted in an enclosure, typically intended to be used in a home or office environment outside of a wiring closet
Rack mounted
Chassis – with swappable “switch module” cards. e.g. Alcatel’s Omni Switch 8000; Cisco Catalyst switch 4500 and 6500; 3Com 7700, 7900E, 8800.
Unmanaged switches – These switches have no configuration interface or options. They are plug and play. They are typically the least expensive switches, found in home, SOHO, or small businesses. They can be desktop or rack mounted.
Configuration options
Managed switches – These switches have one or more methods to modify the operation of the switch. Common management methods include: a serial console or command line interface accessed via telnet or Secure Shell, an embedded Simple Network Management Protocol (SNMP) agent allowing management from a remote console or management station, or a web interface for management from a web browser. Examples of configuration changes that one can do from a managed switch include: enable features such as Spanning Tree Protocol, set port speed, create or modify Virtual LANs (VLANs), etc.
Two sub-classes of managed switches are marketed today:
Smart (or intelligent) switches – These are managed switches with a limited set of management features. Likewise “web-managed” switches are switches which fall in a market niche between unmanaged and managed. For a price much lower than a fully managed switch they provide a web interface (and usually no CLI access) and allow configuration of basic settings, such as VLANs, port-speed and duplex.
Enterprise Managed (or fully managed) switches – These have a full set of management features, including Command Line Interface, SNMP agent, and web interface. They may have additional features to manipulate configurations, such as the ability to display, modify, backup and restore configurations. Compared with smart switches, enterprise switches have more features that can be customized or optimized, and are generally more expensive than “smart” switches. Enterprise switches are typically found in networks with larger number of switches and connections, where centralized management is a significant savings in administrative time and effort. A stackable switch is a version of enterprise-managed switch.
Traffic monitoring on a switched network
Switches
Unless port mirroring or other methods such as RMON or SMON are implemented in a switch, it is difficult to monitor traffic that is bridged using a switch because all ports are isolated until one transmits data, and even then only the sending and receiving ports can see the traffic. These monitoring features rarely are present on consumer-grade switches.
Two popular methods that are specifically designed to allow a network analyst to monitor traffic are:
Port mirroring – the switch sends a copy of network packets to a monitoring network connection.
SMON - “Switch Monitoring” is described by RFC 2613 and is a protocol for controlling facilities such as port mirroring.
Another method to monitor may be to connect a Layer-1 hub between the monitored device and its switch port. This will induce minor delay, but will provide multiple interfaces that can be used to monitor the individual switch port.
Typical switch management features
Turn some particular port range on or off
Link speed and duplex settings
Priority settings for ports
MAC filtering and other types of “port security” features which prevent MAC flooding
Use of Spanning Tree Protocol
SNMP monitoring of device and link health
Port mirroring (also known as: port monitoring, spanning port, SPAN port, roving analysis port or link mode port)
Link aggregation (also known as bonding, trunking or teaming)
VLAN settings
802.1X network access control
IGMP snooping
Link aggregation allows the use of multiple ports for the same connection achieving higher data transfer speeds. Creating VLANs can serve security and performance goals by reducing the size of the broadcast domain.
No comments:
Post a Comment