In 10BASE-T, the Manchester-encoding guaranteed that the line would stay “active” with transitions. 100BASE-TX uses a different approach. This is done by translating every nibble (4bit) block into a 5bit block (4B5B coding). These 5bit blocks are specially designed to have the necessary transitions build in, while only adding 20% overhead, compared to 100% in the Manchester case. The official code-table can be found on page 144 of section 2 of the 802.3 standard [local copy].
100BASE-TX requires UTP cables of Cat5 or higher and utilizes 1 pair for Tx and 1 pair for Rx.
Note that by using the 4B5B encoding, it is no longer necessary to define a bit-order. The transmit-bit-order is specified in the 4B5B code.
The start of a new frame is indicated by a preamble, just as in 10BASE-T. The preamble used is slightly different: 0xJK 55 55 55 55 55 D5. J and K are special symbols that have their own 5bit-symbol in the 4B5B coding. By using a separate symbol for control purposes, it becomes easier to recover from errors: a data symbol can never be misunderstood as a control symbol or the other way around.
Similarly, the end of a frame is indicated with 0xTR. T and R also have a special 5-bit symbol.
Bits to scrambled bits
To comply to the FCC regulations, the resulting bitstream is scrambled. This operation gives the bit-stream more desirable characteristics, especially for cross-talk.
The scrambler used is a simple linear feedback shift register, 11bits long, with taps at the 11th and 9th bit (x11+x9+1). This outputs a 2047bit long pseudo-random bit sequence. For those interested, this textfile shows the output.
The scrambling process itself is a traditional XOR operation: the 4B5B output is XORed bit-by-bit with the scrambler output.
Note that 100BASE-FX (over fiber) does not scramble its bits prior to transmission.
Idle
A 10BASE-T connection is silent between frames (apart from a LIT pulse); 100BASE-T in contrast sends IDLE-symbols. An Idle-symbol is a special 5-bit code (0b11111) different from all data-symbols. Note that this symbol is also scrambled.
A receiver can use this information to synchronize its descrambler: Since the output bit-stream are all 1s, the scrambled output contains the raw scramble-code, inverted. A receiver simply needs to copy and invert 11 bits into its LSFR-scrambler to synchronize.
Bits to voltage
The (scrambled) bit-stream is encoded with a MLT-3 encoding. This Multi-Level Transmit method uses 3 voltage levels to encode a bit, thereby reducing the required bandwidth.
It acquires this goal by cycling through 4 states: 0V, +1V, 0V, -1V. A 1 input-bit changes the output-state; a 0 input-bit results in no output change. The highest attainable frequency is thus 31.25MHz (remember that there are 125M symbol bits to transmit each second after 4B5B encoding).
Additional things
This presentation contains a nice overview of 100BASE-T.
Auto-negotiate allows a device to negotiate its speed and duplex settings with the other side. This is especially useful for multi-speed devices such as 10/100-base-T adapters. The previous spec for auto-negotiate was open for interpretation, leading to incompatible devices. Since 1998, the debatable section was removed from the IEEE 802.3 standard.
Auto-negotiate (ANeg) works by sending a series of short pulses, +1V high, 100ns long. This signal is chosen to stay compatible with 10BASE-T’s LIT (see my post on 10BASE-T for details). Instead of a single pulse, ANeg sends a series of pulses, called the Fast Link Pulse (FLP).
These pulses encode a 16-bit word, which indicates the capabilities of the transmitting device: 10 and/or 100 Mbps, half and/or full duplex. Note that it is normal to support all lower standards as well, however this is not a requirement: A device can advertise that it only supports 100BASE-TX – Full Duplex. This is not the same as setting 100-full-fixed. The former case works in 100-full, but communicates this information to the other side of the link; the latter works in 100-full, but does not inform the other side.
Analysis
The addition of a scrambler significantly increases the unpredictability. This scrambler is not synchronized to frame boundaries, not even to frame bytes. This makes it essentially impossible to construct a frame with a known wire-level signal. Still, I gave it a try:
- If the 4B5B encoded output of the frame matches the output of the scrambler, the resulting (scrambled) bitstream will be a stream of 0’s. MLT-3 encodes this as “no transition”. This will give the receiver-clock a hard time.
After some searching, the bytes 0xB9 20 98 6F C3 result in 50 bits of symbols that match a part of the scrambling-code. Since the scrambler is not synchronized, you need a bit of luck to allign them.
By filling a 1280B frame with this bit-pattern, you have 256 chances to get them alligned: a little more than 12.5% chance.
