Presented by TestEquity - [Link].

com

TCP/IPv4 and Ethernet 10BASE-T/

100BASE-TX Debugging with the
MSO/DPO4000B Series Oscilloscopes
Application Note

Introduction
The Internet changes the way we work and play by providing All references to the MSO/DPO4000B with DPO4ENET in
instant information and worldwide access to products and this application note refer to the MSO/DPO4000B Series
services. The Internet is a global network of computers that Oscilloscope with the DPO4ENET Serial Application Module.
can communicate with each other using Internet Protocol The Internet example used in this application note is a laptop
Suite standards. Because of the Internet popularity and its computer running Microsoft Internet Explorer (IE) that uses the
ease of use there is a growing number of embedded products Internet to control an instrument. In this case the instrument
from cameras to instruments that are connected to the is a second MSO4104B that operates as an embedded
Internet. Designing these embedded products is challenging web server.
and time consuming without the right verification and
This application note begins with an overall view of the
debug tools.
operation of the Internet Protocol Suite which is the foundation
The mixed signal oscilloscope (MSO) is the tool of choice of the Internet implementation. Next, the operation of
to debug embedded systems that have a mixture of analog each Internet Protocol layer is discussed. Throughout the
and digital signals. For quick verification and debugging application note the MSO/DPO4000B with DPO4ENET is
the MSO4000B Series Oscilloscope with the DPO4ENET used to show the examples of the protocol with its data.
Serial Application Module captures and decodes TCP/IPv4/ At the end of this application note is a section on working
Ethernet protocol and data on 10BASE-T/100BASE-TX local with Ethernet 10BASE-T and 100BASE-TX signals with the
area networks (LANs). The MSO4000B Series Oscilloscope MSO/DPO4000B with DPO4ENET.
provides embedded system visibility of time correlated analog
signals, digital signals, parallel buses, serial buses and the
LAN interface to the Internet.
Application Note

Internet Layer Protocol

Application Hypertext Transfer Protocol (HTTP)
Transport Transmission Control Protocol (TCP)
Internet Internet Protocol version 4 (IPv4)
Link Ethernet 10BASE-T & 100BASE–TX
Table 1. Internet Protocol Suite Layers.

Internet Protocol Suite

The operation of the Internet is based on the Internet Protocol
Suite. Protocols are rules and procedures that define the
information format, the process of transmitting information and
the process of receiving information. Internet Protocol Suite
is organized into four layers of protocols: Application layer,
Transport layer, Internet layer and Link layer1 (see Table 1).
These layers use various protocol standards. The standards
Figure 1. Internet protocol layers communicate with same protocol layer on other
used in this application note are Hypertext Transfer Protocol network nodes and the layers above and below it.
(HTTP) for the Application layer, Transmission Control Protocol
(TCP) for the Transport layer, Internet Protocol version 4 (IPv4)
for the Internet layer and Ethernet 10BASE-T and 100BASE-
TX for the Link layer. These protocol standards provide Ethernet 10BASE-T protocol information is added to the IE
networking interoperability among different equipment on web page request as it progresses down through its Internet
the Internet. Protocol layers on the laptop.
Figure 1 shows Microsoft Internet Explorer (IE) in the On the bottom of Figure 1 the Ethernet 10BASE-T twisted
application layer requesting the web page from network pair wires carry the electrical signals between the laptop and
device (oscilloscope). The request begins with the IE Hypertext oscilloscope. The MSO/DPO4000B with DPO4ENET captures
Transfer Protocol2 (HTTP) client in the Application layer on the the electrical signals and decodes the three lower protocol
laptop. Each protocol layer encapsulates the information from layers as is shown in the compressed bus waveform in the
the layer above it with its protocol. Therefore, TCP, IPv4 and bottom of Figure 1.

2 [Link]/ethernet
 TCP/IPv4 and Ethernet 10BASE-T/100BASE-TX Debugging with the MSO/DPO4000B Series Oscilloscopes

Figure 2. Web display in Internet Explorer.

Figure 3. TCP ports to different application types and data encapsulation between
layers.

Figure 4. MSO/DPO4000B color coded decode bus display showing data

encapsulation.

In the oscilloscope each of protocol layers message To quickly identify different packet fields the MSO/DPO4000B
information is decoded and processed as the web page with DPO4ENET decode uses the following color codes. See
request travels up the Internet protocol layers to the HTTP Figure 4.
server in the Application layer. Upon receiving the web page
Start of an Ethernet frame is a green vertical bar
request the oscilloscope HTTP server replies by sending a
HyperText Markup Language (HTML) file to the laptop. Ethernet Preamble (PRE) and Start of Frame Delimiter (SFD)
This HTML file travels down the oscilloscope Internet protocol are purple
layers, across the twisted pair wires and up the laptop Ethernet header is yellow
Internet protocol layers to the IE application. IE displays
IPv4 header is white
the oscilloscope HTML file upon receiving it (see Figure 2).
TCP header is brown
TCP can work with many applications at the same time.
Figure 3 shows TCP having two ports to work with two Data is cyan
different application types. In this case port 80 is for HTTP Ethernet Frame Check Sequence (FCS) is purple
and port 20 is for File Transfer Protocol (FTP).
End of Ethernet frame is a red vertical bar
In Figure 3 the bottom three layers use a formatted unit of
information called a packet. Ethernet standard uses the term
frame instead of packet. Some packets are composed of a
header field and a data field. Usually lower protocol packets
encapsulate higher level packets in their data fields. For
example, a TCP packet with an HTTP application message
is in the IPv4 data field. The IPv4 packet is in an Ethernet
10BASE-T or 100BASE-TX frame data field (see Figure 3).

[Link]/ethernet 3
Application Note

Header Offset Field Name

0-15 bits Source port: 2 bytes
16-31 bits Destination port: 2 bytes
32-63 bits Sequence number: 4 bytes
64-95 bits Acknowledgment number: 4 bytes
96-99 bits Data offset: 4 bits
100-103 bits Reserved: 4 bits
104-111 bits Eight Flags: 8 bits
Figure 5. In this Ethernet 10BASE-T acquisition the TCP packet starts with source port
112-127 bits Window: 2 bytes number 81.
128-143 bits Checksum: 2 bytes
144-159 bits Urgent pointer: 2 bytes
160-… bits Options
Transmission Control Protocol (TCP)
Table 2. TCP packet format.
Transmission Control Protocol4 (TCP) is a widespread
protocol used in the Transport layer of the Internet Protocol
Suite. TCP reliably exchanges data between network nodes.
Hypertext Transfer Protocol (HTTP) TCP is responsible for guarantee packet delivery, proper
Starting at the top Application layer, HTTP is one of the core packet sequencing, packet acknowledgment, avoidance of
protocols of the World Wide Web. A web browser uses HTTP duplicate packet delivery and packet integrity.
to obtain formatted information from HTTP servers. The web The TCP packet contains a header with 10 fields plus an
browser is a client and it uses HTTP to request HTML files, optional extension field. The TCP packet includes information
images, movies, forms, etc. from a HTTP server. The HTTP on the port number, flags, sequencing numbers, etc. (see
server can be a web site on a network server or an embedded Table 2). The port number allows multiple connections
systems device like a web camera or a instrument. between two network nodes. Different applications types use
Both IE and the oscilloscope understand HTTP and HTML different ports between the Application layer and the TCP.
protocol and they successfully work together. Also, the IE
HTTP client and the oscilloscope HTTP server are Application
layers that know how to work with their Transport layers below
them in order to communicate to the other device (see
Figure 1).

4 [Link]/ethernet
 TCP/IPv4 and Ethernet 10BASE-T/100BASE-TX Debugging with the MSO/DPO4000B Series Oscilloscopes

Header Offset Field Name

0-3 bits Version
4-7 bits Internet Header Length (IHL)
8-13 bits Differentiated Services Code Point (DSCP)
14-15 bits Explicit Congestion Notification (ECN)
16-31 bits Total Length
32-47 bits Identification
48-50 bits Flags
Figure 6a. MSO/DPO4000B with DPO4ENET decodes IPv4 packets and triggers on
51-63 bits Fragment Offset IPv4 packet fields. This Ethernet 10BASE-T acquisition shows the first IPv4 field is
64-71 bits Time To Live (TTL) version 4, the second field is Internet Header Length 5, etc.

72-79 bits Protocol

80-95 bits Header Checksum
12-15 bytes IPv4 Source Address
16-19 bytes IPv4 Destination Address
20-23 bytes Options
20 or 24 bytes Data
Table 3. IPv4 packet format.

Internet Protocol (IPv4)

Figure 6b. IPv4 protocol field is TCP which means a TCP message is in the IPv4
Internet Protocol5 version 4 (IPv4) is used in the Internet data field.
Protocol Suite Internet layer. Computers and devices use
IPv4 addresses to locate and talk to each other on the Internet.
The IPv4 address identifies the network and a unique Link Layer
network node. The bottom layer in the Internet Protocol Suite is the Link layer
IPv4 transports packets from the source network node to the which provides the physical interface between network nodes.
destination network node on the Internet. This works across The interface can be electrical wiring, optical fiber or wireless.
network boundaries and uses gateways between networks. In Data is transferred between network nodes based on a
order to accomplish this task IPv4 handles the addressing and physical hardware address.
packet routing. A popular link layer implementation is Ethernet 10BASE-T
IPv4 address is a logical address that is independent of the and 100BASE-TX. Ethernet 10BASE-T and 100BASE-TX
hardware addressing of the LAN and works with different are supported by most computers. The popularity of
LAN implementations. IPv4 maps the logical address to the 10BASE-T and 100BASE-TX and their decreasing hardware
hardware address. IPv4 address is unique and it can include a implementation cost has caused them to be incorporated in
network number, subnet number and a network node number. embedded systems such as the cameras, security systems,
IPv4 address is composed of four-bytes (32-bit) and is written instruments, etc.
in dot-decimal notation. Each byte is shown in decimal and is
separated by periods. A byte ranges from 0 to 255 decimal.
The IPv4 packet contains header fields and a data section.
The IPv4 fields are Protocol, IPv4 Source Address, IPv4
Destination Address, data fields, etc. (see Table 3).

[Link]/ethernet 5
Application Note

Header Offset Field Name

0-6 bytes Preamble (PRE): 7 bytes
7 bytes Start-of-frame Delimiter (SFD): 1 byte
8-13 bytes Destination Address (DA): 6 bytes
14-19 bytes Source Address (SA): 6 bytes
20-21 bytes Length/Type: 2 bytes
22 bytes Data+Pad; 46-1500 bytes
At end of data Frame check sequence (FCS): 4 bytes
Figure 7. Ethernet Preamble (PRE) and Start-of-frame Delimiter (SFD).
Table 4. Ethernet 10BASE-T and 100BASE–TX frame format.

Ethernet
The Ethernet frame is a basic unit of data transfer on the LAN
and the frame flows in a one direction.
Ethernet frame is a sequence of seven fields. Ethernet
frame includes information on the Ethernet source address,
destination address, packet size, length/frame type and data
(see Table 4). The Ethernet frame size has a minimum length
in order for collision detection to work in half duplex mode.
The frame transmission begins with a Preamble (PRE) Figure 8. Ethernet 10BASE-T MAC Destination Address and MAC Source Address.
and the PRE is used by a 10BASE-T receiver for start-up
synchronization. The PRE is at least seven bytes long and is
an alternating pattern of ones and zeros (see Figure 7). The Start-of-frame Delimiter (SFD) indicates the start of a
frame after it and the SFD immediately follows the PRE. The
The PRE starts with one and ends with zero. The first PRE
SFD is the second part of the PRE. The SFD is one byte long
bit (one) may have phase violations or invalid amplitude since
with pattern of 10101011. The frame fields follow the SFD.
it is starting from zero volts. Also, some PRE implementations
may have additional one-zero pairs beyond the required The Destination Address and the Source Address follow the
seven bytes. SFD and they are both six bytes long (see Figure 8). These
addresses are physical addresses and they are also called
100BASE-TX has the same PRE field for backward
Media Access Control (MAC) addresses. A MAC address is a
compatibility but does not need the PRE for receiver
hardware address unique to the network node hardware. Each
synchronization because the 100BASE-TX electrical encoding
network node has a unique factory installed MAC address.
is different than 10BASE-T. The 10BASE-T signals are
This hardware address guarantees a unique identity to each
zero when the 10BASE-T frame is not transmitting. The
network node on the LAN.
100BASE-TX transmits an idle signal between frames
and never stops transmitting like 10BASE-T. Therefore,
100BASE-TX receiver always has a signal for keeping
synchronization.

6 [Link]/ethernet
 TCP/IPv4 and Ethernet 10BASE-T/100BASE-TX Debugging with the MSO/DPO4000B Series Oscilloscopes

Figure 9. Ethernet broadcast address [Link] from MAC address

[Link]. The second line of the Event table shows the IPv4 packet
contains a UDP packet.

Figure 10. Ethernet 10BASE-T Length/Type (MAC Type) with the Internet protocol type
0800 hexadecimal. After the Length/Type is the Ethernet frame data field which contains
the IPv4 packet.

uses the last three MAC address bytes to identify a specific

Ethernet interface. Therefore, an Ethernet interface MAC
address is unique on a LAN.
The Length/Type field is the number of Logical Link Control
(LLC) bytes if equal or less than 1,500 (05DC hexadecimal).
Figure 11. 10BASE-T four byte FCS Frame check sequence (FCS) with TP_IDL signal
at the end. Length/Type is a type if it is greater than 1536 (0600
hexadecimal). For example, type 2,048 (0800 hexadecimal)
is the Internet protocol as is shown in Figure 10 and type
MAC address is organized into groups of two hexadecimal
33,024 (8100 hexadecimal) is Virtual LAN (VLAN).
digits. 10BASE-T and 100BASE-TX transmits the MAC
address bytes from left-to-right with least significant bit in The Ethernet frame data is 46 to 1500 bytes. If the data is less
each byte first. than 46 bytes the data field is filled with a pad to become
46 bytes long. This pad makes sure the total packet length is
The Destination Address can contain a Multicast address
long enough to recognize a collision for a round trip delay of
representing a group of network nodes. All network nodes
50 microseconds.
part of the multicast address will receive the frame. Also, all
network nodes will receive a Broadcast address which is The Frame Check Sequence (FCS) is four bytes long (32-bit)
address of all one’s ([Link]). In Figure 9 the cyclic redundancy check (CRC) value used for error detection.
MSO/DPO4000B with DPO4ENET captured a Broadcast The CRC includes Destination Address, Source Address,
and it is decode as an event table. The Event table can be Length/Type, Data and Pad fields. The FCS MSB is transmitted
saved for documentation and for analysis by other tools. first and the LSB is transmitted last.

The IEEE Registration Authority allocates and registers An idle signal (TP_IDL) is transmitted when 10BASE-T packets
Organizationally Unique Identifiers (OUI). The OUI is the first are not being transmitted. At the end of the 10BASE-T FCS
three bytes of the MAC address. The OUI is assigned to a may be a start of idle (TP_IDL). A TP_IDL always starts with a
manufacturer of Ethernet interfaces. For example, the OUI one at the end of the FCS and stays one for two bit times (at
08-00-11 is assigned to Tektronix, Inc. The manufacturer least 250 ns for 10BASE-T, see Figure 10).

[Link]/ethernet 7
Application Note

Figure 13. Ethernet 10BASE-T Manchester 11000101 coding with a transition in the
middle of each bit.

Between Ethernet frames are interframe gaps (IFG) of 96 bits.

The 10BASE-T IFG is 9.6 µs and the 100BASE-TX IFG is 960
ns. When a network node transmits multiple frames it must
wait for a period equal to the IFG between each frame before
transmitting the next frame.

10BASE-T
Figure 12. During 10BASE-T IDLE the link test pulse is transmitted every 16 ms ±8 ms. Ethernet 10BASE-T defines a specific physical connection
between networks nodes. 10BASE-T uses Category 3 (CAT3)
cable or better with two unshielded twisted-pair (UTP) wires.
These twisted-pair wires are referred to as the media in the
IEEE specifications. One pair is for transmit and the other pair
is for receive. Each pair is a differential signal. None of the
cable wires are connected to ground at the network nodes.

10BASE-T Manchester Code

Ethernet 10BASE-T is Manchester encoded data in which
data and clock signals are combined to form a single self-
synchronizing data stream. A transition always occurs in the
middle of each bit and the bit cell period is 100 ns. The first
half of the bit is the complement of the last half of the bit. As
a result, 10BASE-T has no DC component.
The IEEE Std 802.3TM-2008 Manchester encoded data
defines the middle bit rising edge as a logical one and the
middle bit falling edge as a logical zero. In other words, a
logical one is a high voltage at the end of the bit and a logical
zero is a low voltage at the end of the bit (see Figure 13).
Figure 14. Ethernet 10BASE-T Manchester encoded address with the least significant
bit first in the byte.

After the start of TP_IDL there are no transitions (differential

voltage remains at 0 mV ± 50 mV) until the next Ethernet
frame or link test signal. During TP_IDL the 10BASE-T link
test is transmitted every 16 ms ±8 ms. The link test signal is a
positive pulse 585 mV to 3.1V and it is a minimum of ~60 ns
wide and a maximum of ~200 ns wide.

8 [Link]/ethernet
 TCP/IPv4 and Ethernet 10BASE-T/100BASE-TX Debugging with the MSO/DPO4000B Series Oscilloscopes

Figure 15. An Ethernet 10BASE-T Manchester code of all ones is a 10 MHz waveform. Figure 16. An Ethernet 10BASE-T Manchester code of all zeros is a 10 MHz waveform.
All zeros pattern is different from an all ones pattern by the phase offset.

Serial Application
Ethernet Oscilloscope Probe Module
MSO/DPO4104B TDP0500 500
10BASE-T
MSO/DPO4054B MHz Differential DPO4ENET
100BASE-TX
MSO/DPO4034B Probe
Table 5. 10BASE-T and 100BASE–TX recommend equipment configuration.

Figure 17. Fluke 8-Wire In-Line Modular Adapter.

The CAT5 cable does not have a ground reference signal.

Therefore, a TDP0500 Differential Probe accesses 10BASE-T
signals using a Fluke Networks 8-Wire In-Line Modular
Adapter (10230100). AutoZero the TDP0500 probe before
connecting it to 10BASE-T signals by attaching both probe
inputs to the oscilloscope front panel Probe Comp ground.
Next, select the TDP0500 4.25 V scale and AutoZero the
Figure 18. Positive link pulse confirms the differential probe is correctly connected to
the Ethernet 10BASE-T twisted pair.
probe. The TDP0500 D+ is connected to pin 1 and TDP0500
D- is connected to pin 2.

An all ones burst or all zero burst is a 10 MHz waveform (see There are two methods to quickly check that the TDP0500
Figures 15 and 16). The difference between all ones and probe is connected correctly. The first method, the link test
all zeros is the phase of the square wave which is very pulse is a solitary positive pulse when the 10BASE-T LAN is in
difficult to determine in the middle of a data stream. The the idle state. The link test pulse first goes positive (minimum
MSO/DPO4000B with DPO4ENET saves your time by 585 mV and maximum of 3.1 V) for minimum of 60 ns (Figure
automatically decoding the Ethernet 10BASE-T Manchester 18). In the idle state link test pulses repeat 16 ms ±8 ms and
coded signal after each acquisition. between the link pulses the signal is at 0 mV ± 50 mV (see
Figure 12).
Working with Ethernet 10BASE-T
The MSO/DPO4000B Series Oscilloscope with DPO4ENET
Serial Application Module triggers, decodes and searches
on TCP, IPv4 and Ethernet frame protocol on 10BASE-T and
100BASE-TX signals. Table 5 shows the recommend equipment
configurations for 10BASE-T and 100BASE-TX signals.

[Link]/ethernet 9
Application Note

Figure 19. Two bit positive TP_IDL signal at the end of the Ethernet 10BASE-T Figure 20. Ethernet 10BASE-T frame acquisition triggered on SFD.
frame confirms the differential probe is correctly connected to the Ethernet 10BASE-T
twisted pair.

The Ethernet 10BASE-T frame without the PRE, SFD and

Minimum Scope Time Span at 20 M
Ethernet Bit Period Sampling Rate record length TP_IDL has a maximum of 1,518 bytes (1.2144 ms) when
not including a Virtual LAN (VLAN) tag header (four-bytes).
10BASE-T 100 ns 100 MS/s 200 ms
The oscilloscope is set to 1M record length and the horizontal
100BASE-TX 8 ns 1 GS/s 20 ms
scale is set to 1 ms/division. As result, the Ethernet 10BASE-T
Table 6. Minimum sampling rate requirements to decode 10BASE-T and 100BASE–TX. signal is sampled at 100 MS/s and the acquisition time span
is 10 ms which will capture the complete packet if it is at the
The second method, at the end of a FCS there might be a maximum 1.2144 ms packet size.
TP_IDL signal that starts with a one and is one for 2-bit times The front panel blue Bus buttons are used to define an
(200 ns). Therefore, the TP_IDL signal is a minimum of 250 ns Ethernet 10BASE-T bus by entering the bus parameters which
and is positive (see Figure 19). includes selecting 10BASE-T, differential probe, thresholds
The MSO/DPO4000 vertical scale is set so that differential and turning on/off TCP/IPv4 decoding. A good starting point
signal fills the vertical display as much as possible without for 10BASE-T thresholds is the preset values 500 mV for logic
clipping the waveform. A good starting point is 500 mV/ high and -500 mV for logic low. The Low threshold is the same
division and you might need to adjust the vertical Fine Scale. as the front panel Trigger Level and changing one will change
The oscilloscope bus decoding requires a minimum of eight the other. The oscilloscope is configured to trigger on SDF and
to ten samples for each bit period for successful decoding. is put in Single acquisition mode (see Figure 20).
Therefore, 100 MS/s is the slowest sampling rate used for
decoding a clean 10BASE-T signal (see Table 6).

10 [Link]/ethernet
 TCP/IPv4 and Ethernet 10BASE-T/100BASE-TX Debugging with the MSO/DPO4000B Series Oscilloscopes

Figure 21. Ethernet 10BASE-T frame acquisition interframe gap is measured at 9.6 µs Figure 22. Ethernet 10BASE-T frame acquisition interframe gap is 12.68 µs on the
with the cursors and a collision between the two signals. bottom 10BASE-T waveform after the first collision. A second collision occurred on the
right side of the display after the bottom channel started transmitting its PRE.

In Figure 21 the cursors are used to measure the interframe 100BASE-TX

gap (IFG) of 96 bits which is equal to 9.6 µs. Also, a collision
occurred in the middle of the preamble (PRE) of the top Ethernet 100BASE-TX is part of the Fast Ethernet standards
10BASE-T waveform and the start of the bottom 10BASE-T that carry traffic at the nominal rate of 100 Mbit/s over
waveform. Both network nodes recognized the collision and Category 5 (CAT5) or better cable. In the CAT5 cable
stopped transmitting. 100BASE–TX uses one pair for transmission and another pair
for collision detection and receive. 100BASE–TX operates in
After the first collision the bottom channel waited for 12.68 µs half-duplex or full-duplex mode just like 10BASE-T.
before started transmitting and the top channel waited for
15.88 µs before transmitting that resulted in a second collision
as shown in Figure 22. After the second collision the bottom
10BASE-T signal was successful in transmitting its packet.

[Link]/ethernet 11
Application Note

Hex Data Input 4b Output 5b Symbols Description Output

0 0000 11110 I IDLE 11111
1 0001 01001 J Start #1 11000
2 0010 10100 K Start #2 10001
3 0011 10101 T End 01101
4 0100 01010 R Reset 00111
5 0101 01011 H Transmit Error 00100
6 0110 01110 Table 8. 100BASE–TX symbols.

7 0111 01111
8 1000 10010 4B5B binary encoding is used to prevent a long string of zeros
9 1001 10011 resulting in no data edges for the receiver clock synchronization.
A 1010 10110 See Table 7. 4B5B binary encoding transforms four bits into
five bits with a data pattern of a maximum of one leading zero
B 1011 10111
and a maximum of two trailing zeros. The bit rate changes
C 1100 11010
from the 4B5B input of 100 Mbps (10 ns per bit) to 125 Mbps
D 1101 11011 (8 ns per bit) at the output.
E 1110 11100
The four bit data uses 16 five bit output codes. This leaves
F 1111 11101
16 other output codes to be used for protocol. For example,
Table 7. 100BASE–TX 4b5b encoding. see Table 8 that shows output codes definitions for IDLE (I),
Control (J, K, T and R) and Transmit Error (H). The rest of
the unused five bit output codes are undefined and are
100BASE-TX 4B5B, Scrambling and invalid codes.
MLT-3 Code
Ethernet 100BASE-TX encoding is based on ANSI X3.263-
1995 (TP-PMD) standard. The transmission goes through
three transformations. First, the transmission is 4B5B binary
encoded to prevent a string of zeros that may cause the
receiver to lose clock synchronization lock. Second the
transmission is scrambled to minimize electromagnetic
emissions. Last the transmission in encoded with Multi-Level
Transmit -3 (MLT-3) to reduce the high frequency content
of the signal. These three transformations make it almost
impossible to hand decode a 100BASE-TX signal.

12 [Link]/ethernet
 TCP/IPv4 and Ethernet 10BASE-T/100BASE-TX Debugging with the MSO/DPO4000B Series Oscilloscopes

Figure 23. 100BASE-TX scrambled waveform. Compare this waveform with Figure 24 Figure 24. 100BASE-TX scrambled waveform. Compare this waveform with Figure 23
which is the same data at a different time with a different waveform. which is the same data at a different time with a different waveform.

After 4B5B encoding the transmission is scrambled to minimize

electromagnetic emissions. The scrambled transmission
results in different waveform patterns for the same data values
being sent at different times. See Figures 23 and 24.
The Multi-Level Transmit-3 (MLT-3) encoding uses three
voltage levels (three states). MLT-3 cycles consecutively
through the states -1, 0, +1, 0, -1, 0, +1, 0, etc. Logic high
causes a move to the next state and logic low results in
staying in the same state.
The four bit input symbol rate is 100 Mbps (10 ns/bit) and the
4B5B output symbol rate is 125 Mbps (8 ns/bit). After MLT-3
encoding the maximum fundamental frequency is 31.25 MHz.
See Figure 25.
Figure 25. 100BASE-TX MLT-3 encoding maximum fundamental frequency is 31.25
MHz.
For Unshielded Twisted Pair cable the MTL-3 differential signal
is from 950 mV to 1050 mV.
The 100BASE–TX link integrity is verified by the reception of
the IDLE symbol which is transmitted between frames. Also,
the IDLE symbol maintains receiver clock synchronization.
The 100BASE–TX Start-of-Stream delimiter (SSD) is before
the Ethernet frame PRE and is the symbol sequence J
followed by K. The 100BASE–TX End-of-Stream Delimiter
(ESD) follows the Ethernet frame FCS and is the symbol
sequence T followed by R. The H symbol is used to propagate
receive errors.

[Link]/ethernet 13
Application Note

Start Frame Delimiter.

MAC Addresses.
Trigger on source and destination 48-bit addresses.
MAC Length/Type.
Trigger on ≤, <, =, >, ≥, ≠ a particular 16-bit value, or inside or outside
of a range.
MAC Client Data.
Trigger on ≤, <, =, >, ≥, ≠ a particular data value, or inside or outside
of a range. Selectable number of bytes to trigger on from 1 - 16. Byte
offset options of don't care, 0 - 1499.
MAC Q-Tag Control Information.
Trigger on Q-Tag 32-bit value.
IP Header.
Trigger on IP header 4-bit value, Source Address, Destination Address.
Figure 26. Ten Ethernet 100BASE-TX frames are marked at the SFD in the 20 ms
acquisition. Navigation between the frames SFD is done simply with Wave Inspector
TCP Header.
front panel arrows buttons. Trigger on Destination Port, Source Port, Sequence Number, and Ack
Number.
TCP/IPv4 Client Data.
Working with Ethernet 100BASE-T Trigger on ≤, <, =, >, ≥, ≠ a particular data value, or inside or outside
of a range. Selectable number of bytes to trigger on from 1 - 16. Byte
The 100BASE-TX probing configuration is the same as
offset options of don't care, 0 - 1499.
10BASE-T in the previous section. As is shown in Table 9
End of Packet.
the minimum recommended sampling rate is 1 GS/s for
FCS (CRC) Error.
100BASE-TX. The MSO/DPO4000B maximum time span at
1 GS/s is 20 ms when the MSO/DPO4000B is configured for Table 9. MSO/DPO4000B Series Oscilloscopes with the DPO4ENET Serial Application
Module 10BASE-T Triggering and Searching
20 Mpoint record length and 2.00 ms/division. The trigger is
set to Ethernet 100BASE-TX Start of Frame (SFD) and a single
Start Frame Delimiter.
acquisition was taken.
MAC Addresses.
The MSO/DPO4000B Series Oscilloscopes all have up to Trigger on Source and Destination 48-bit address values.
a 20 Mpoint waveform record on all channels. This is over
MAC Q-Tag Control Information.
20,000 full resolution screens of data. It takes over five
Trigger on Q-Tag 32-bit value.
and a half hours to scroll through a 20 Mpoint waveform
MAC Length/Type.
at the rate of one full resolution screen (1,000 points) per
Trigger on ≤, <, =, >, ≥, ≠ a particular 16-bit value, or inside or outside
second. MSO/DPO4000B Wave Inspector is a search and
of a range.
navigation function that simplifies the task of working with
IP Header.
large acquisitions. The MSO/DPO4000B trigger and search
Trigger on IP header 4-bit value, Source Address, Destination Address.
functions are integrated in that the trigger settings are copied
TCP Header.
to search and the search settings are copied to trigger. In this
Trigger on Destination Port, Source Port, Sequence Number, and Ack
case the Ethernet 100BASE-TX Start of Frame trigger setting
Number.
is copied to the search. The Wave Inspector searched and
TCP/IPv4 Client Data.
marked all ten SFDs in the 20 Mpoint record in a few seconds.
Trigger on ≤, <, =, >, ≥, ≠ a particular data value, or inside or outside
The SFD marks are the white hollow triangles above the
of a range. Selectable number of bytes to trigger on from 1 - 16. Byte
waveforms in Figure 26. Notice that 100BASE-TX transmits a offset options of don't care, 0 - 1499.
continuous IDLE symbol and the twisted pair wires are always MAC Client Data.
active which makes it very difficult to visually find the packets Trigger on ≤, <, =, >, ≥, ≠ a particular data value, or inside or outside
in the 20 Mpoint acquisition without the marks. Now that the of a range. Selectable number of bytes to trigger on from 1 - 16. Byte
SFD has been found and marked, navigating between Start offset options of don't care, 0 - 1499.
of Frame occurrences is as simple as pressing the Wave End of Packet.
Inspector front-panel Previous and Next arrow buttons. Idle.
FCS (CRC) Error.
Table 10. MSO/DPO4000B Series Oscilloscopes with the DPO4ENET Serial Application
Module 100BASE-TX Triggering and Searching.

14 [Link]/ethernet
 TCP/IPv4 and Ethernet 10BASE-T/100BASE-TX Debugging with the MSO/DPO4000B Series Oscilloscopes

Figure 27. A 100BASE-TX acquisition that triggered on the HTTP “GET” command in
the TCP data field.

Figure 28. 100BASE-TX template mask test based on IEEE Std 802.3-2008.

The TDSET3 Ethernet Compliance Test Software provides

a wide range of tests for debugging and validating the
Ethernet 10BASE-T, 100BASE-TX and 1000BASE-T physical
layers. TDSET3 offers one-button automatic testing with
accurate normalization and disturber removal that ensures
reliable results. Automatic jitter measurements eliminate
user intervention for fast and reliable measurements. Mask
auto-fit and locate hits minimize testing time (see Figure 28).
Automatic pass/fail notification provides quick results and the
report generator saves time documenting the test results (see
Figure 29. Pass/Fail status with detailed report.
Figure 29).

Summary
MSO/DPO4000B Trigger & Search Ethernet and related serial buses are industry standards and
The MSO/DPO4000B Series Oscilloscopes with the DPO4ENET can be found in many of embedded designs today. Traditional
Serial Application Module provides a comprehensive set of manual decoding methods being used to decode these buses
trigger functions for Ethernet 10BASE-T and 100BASE-TX are time-consuming. Debugging and finding the cause of the
signals. Higher level trigger functions include TCP/IPv4 design problems can be simplified with automated tools for
protocol and client data as is shown in Tables 9 and 10. triggering, decode and search.
Figure 27 shows a 100BASE-TX acquisition that triggered
The MSO/DPO4000B Series oscilloscope with the DPO4ENET
on the HTTP GET command in the TCP data field.
Serial Application Module quickly captures and analyzes TCP/
IPv4/Ethernet frame protocols on 10BASE-T and 100BASE-
10BASE-T and 100BASE-TX Physical TX signals. These decoded protocols and waveforms are time
Layer Compliance correlated on the oscilloscope display with other serial/parallel
Without proper signal fidelity system interoperability may be buses, analog signals and digital signals to provide complete
unreliable. With the wide range of operating conditions found design visibility to quickly verify and debug an embedded
in networking systems determining the impact of design system. The TDSET3 Ethernet Compliance Test Software
variances on signal integrity performance is important. Testing with the appropriate oscilloscope offers comprehensive analog
Ethernet requires basic parametric measurements such validation, compliance testing, and device characterization
as amplitude and rise time as well as jitter, mask tests and of the Ethernet 10BASE-T, 100BASE-TX and 1000BASE-T
many others. Tektronix provides Ethernet 10BASE-T and physical layers.
100BASE-TX electrical signal compliance testing with the
TDSET3 Ethernet Compliance Test Software with the
MSO/DPO5000 Series, DPO7000 Series and DPO/DSA/
MSO70000 Series oscilloscopes.
[Link]/ethernet 15
References Contact Tektronix:
ASEAN / Australasia (65) 6356 3900
IETF RCFs are available at [Link] and check to Austria* 00800 2255 4835
see what other RFCs are related to the one you are accessing. Balkans, Israel, South Africa and other ISE Countries +41 52 675 3777
Belgium* 00800 2255 4835
1. IETF RFC-1122 Requirements for Internet Hosts -- Brazil +55 (11) 3759 7600
Communication Layers. Canada 1 (800) 833-9200
Central East Europe, Ukraine and the Baltics +41 52 675 3777
2. IETF RFC-2616 Hypertext Transfer Protocol -- HTTP/1.1.
Central Europe & Greece +41 52 675 3777
3. W3C HTML 4.01 Specification is at Denmark +45 80 88 1401
[Link] Finland +41 52 675 3777
France* 00800 2255 4835
4. IETF RFCs related to TCP are RFC 3168, RFC 2581, Germany* 00800 2255 4835
RFC 1122, RFC 793 and RFC 675. Hong Kong 400-820-5835
India 000-800-650-1835
5. IETF RFCs related to IPv4 are RFC 3260, RFC 3168,
Italy* 00800 2255 4835
RFC 2474, RFC 1349 and RFC 791. Japan 81 (3) 6714-3010
6. The Physical Layer Compliance Testing for 100BASE-TX Luxembourg +41 52 675 3777
Mexico, Central/South America & Caribbean 52 (55) 56 04 50 90
(61W-17381-2) application note describes how TDSET3
Middle East, Asia and North Africa +41 52 675 3777
Ethernet Compliance Test Software provides wide range of
The Netherlands* 00800 2255 4835
100BASE–TX tests that ensure validation. Norway 800 16098
7. IETF RFC-1180 A TCP/IP Tutorial. People’s Republic of China 400-820-5835
Poland +41 52 675 3777
8. 10BASE-T and 100BASE–TX specifications are part of Portugal 80 08 12370
the IEEE Std 802.3TM-2008 Part 3: Carrier sense multiple Republic of Korea 001-800-8255-2835
access with Collision Detection (CSMA/CD) Access Russia & CIS +7 (495) 7484900
Method and Physical Layer Specifications. IEEE Std 802.3™- South Africa +27 11 206 8360
Spain* 00800 2255 4835
2008 are located at [Link] getieee802/
Sweden* 00800 2255 4835
[Link]
Switzerland* 00800 2255 4835
Taiwan 886 (2) 2722-9622
United Kingdom & Ireland* 00800 2255 4835
USA 1 (800) 833-9200

* If the European phone number above is not accessible,

please call +41 52 675 3777

Contact List Updated 25 May 2010

For Further Information

Tektronix maintains a comprehensive, constantly expanding collection of
application notes, technical briefs and other resources to help engineers
working on the cutting edge of technology. Please visit [Link]

Copyright © 2010, Tektronix. All rights reserved. Tektronix products are

covered by U.S. and foreign patents, issued and pending. Information in this
publication supersedes that in all previously published material. Specification
and price change privileges reserved. TEKTRONIX and TEK are registered
trademarks of Tektronix, Inc. All other trade names referenced are the service
marks, trademarks or registered trademarks of their respective companies.

12/10 EA/WWW 55W-26293-0