716 ChAPTER 24: Digital Evidence on Physical and Data-link layers Table 24.1 Different types of Ethernet IEEE 802.3 Standard 10Base5 (thick Ethernet) 10BaseT (twisted-pair Ethernet) 100BaseT 1000BaseT Cable 1/2" yellow coaxial Twisted pair Twisted pair Twisted pair Max Cable Length (m) 500 100 100 100 Throughput (Mbps) 10 10 100 1000 24.1.3 CSMA/CD Although Carrier Sense Multiple Access with Collision Detection (CSMA/ CD) is a mouthful, the concept is straightforward: it is a "listen before acting" access method. Recall the analogy of the polite dinner conversation described in Chapter 21. At a polite dinner party, an individual who has something to say waits for a break in the conversation before speaking. If two people start to speak at the same time, they both stop for a moment before starting to speak again. Similarly, when two computers using Ethernet start to transmit data at the same time, they both sense that the other host is transmitting and they both stop for a random period of time before transmitting again. This method of communication works well as long as there are not too many hosts con- nected to the same wire. Having too many hosts on the network will result in many collisions and not enough successful communication. 24.2 lINKING ThE DATA-lINK AND NETWORK lAyERS: ENCAPSulATION In addition to connecting computers to the network, the data-link layer prepares data for their journey through the physical layer. For example, before sending an IP packet, Ethernet adds a header and checksum (a number used to verify the integrity of the data), encapsulating the packet in an Ethernet frame. Table 24.2 shows the segments of an IP packet encapsulated in an Ethernet frame. Why are two types of addresses required--an IP address and a MAC address? Each address serves a different purpose. Put simply, Ethernet enables communi- cation between hosts on the same network using MAC addresses while TCP/IP enables communication between hosts on different networks using IP addresses. Computer applications use TCP/IP to communicate, regardless of the network technology involved and computers themselves use the local network technol- ogy to exchange data. So, before an IP packet can be transmitted through the physical and data-link layers, it must be encapsulated in the local language (e.g., Ethernet, ATM, or FDDI). For instance, at the data-link layer, Ethernet uses a particular kind of MAC address (e.g., 08-00-56-12-97-A8) to direct data, encap- sulating IP packets into Ethernet frames as shown in Table 24.2. Recall from Chapter 21 that when a computer on one Ethernet network needs to send information to a computer on another network, it must send the