IT Baseline Protection Manual - The Information Warfare Site

Safeguard Catalogue - Communications Remarks
____________________________________________________________________ .........................................
- For this reason a bridge also raises the data throughput in each segment, as
data can be transmitted independently on either side of the bridge, thus
achieving a separation of loads.
Switches (Ethernet, Token-Ring, ATM)
A switch is a variant of a bridge which links several logical LAN segments
(multi-port bridge), and operates on layer 2 of the OSI model. Some new
products also implement a switching functionality on layer 3 of the OSI
model, thus allowing segmentation on this layer.
An Ethernet switch consists of several bridges connected together internally in
an appropriate manner (e.g. via a switching matrix).
An Ethernet switch provides the advantages of a bridge for several ports (8 to
32 ports per switch are standard at present), i.e. every subscriber and every
segment at a switch port comprises a separate collision domain, and
connections are established on demand. This allows every connected segment
to communicate with any other segment, irrespective of the network traffic
and load, provided that it is not already busy. Switches are particularly
suitable for load separation and as central coupling elements for several subsegments.
Cascading switches, i.e. connecting secondary switches to a central
switch, allow the formation of extremely high-performance networks, given
that an appropriate, logical network structure has been selected.
Ethernet switches which operate in accordance with the IEEE standard for
bridges use the store-and-forward technique. With this technique, the entire
Ethernet packet of the source port is first read in and checked for correctness.
Only packets which have been received correctly and completely are
forwarded to the target segment. Such switches generate relatively long delay
times, but also guarantee that no faulty packets are routed to other segments.
The use of such store-and-forward switches is advisable in situations where
maximum availability and integrity are of greater importance than bandwidth.
In contrast, alternative techniques which have also been developed increase
the throughput of an Ethernet switch, i.e. shorten the delay times involved in
the processing of data packets. One such technique, termed on-the-fly or cutthrough,
does not read in and check entire data packets; instead, it just
evaluates the target address of a packet and then sends the whole packet
immediately to this address. On-the-fly switches are thus up to 20 times faster
than store-and-forward switches. However, they can also route faulty packets
to other segments, thus impairing the bandwidth and, under certain
circumstances, the availability of the segments in question. For this reason,
on-the-fly switches should be used in networks characterised by an infrequent
occurrence of faulty packets and requiring the maximum throughput. Most
manufacturers now offer switches which incorporate both technologies and
can thus be configured as required.
Some products now also support switching on layer 3 of the OSI model. In
this case, network subscribers are no longer distinguished by their MAC
address (layer 2 switching), but by the addresses on layer 3 (for the TCP/IP
protocol stack, this is the IP address). Layer-3 switching can further enhance
performance; for this though, the switch must be able to process the protocols
used on layer 3, similar to a router.
____________________________________________________________________ .........................................
IT-Baseline Protection Manual: Oktober 2000