How a Mixed‑Signal Oscilloscope Reveals Ethernet’s Physical‑Layer Secrets

Article Overview

The study uses twisted‑pair Ethernet as the analysis target and a mixed‑signal oscilloscope as the analysis tool to explore two common Ethernet encoding schemes, verify physical‑layer signal transmission, and compare software‑captured data with oscilloscope‑captured signals.

Ethernet Overview

Ethernet (IEEE 802.3) is a widely used networking technology. Most Ethernet implementations use twisted‑pair cables defined by TIA/EIA‑568. Both 10Base‑T and 100Base‑TX can operate over the same cable, with pin definitions shown in Figure 1.

10Base‑T Ethernet

10Base‑T transmits at 10 Mbps using Manchester encoding, where a logical “0” is represented by a falling edge and a logical “1” by a rising edge. Figure 3 shows a captured differential waveform; the bit value can be identified by the direction of each edge.

Using the oscilloscope’s bus‑decode function, the Ethernet protocol can be selected, the speed set to “10 Base‑T”, and the signal type set to “differential”. The decoded result (Figure 5) reveals an IPv4 frame with MAC address and other packet details.

100Base‑TX Ethernet

100Base‑TX increases the data rate to 100 Mbps and employs three encoding steps: 4B5B, MLT‑3, and NRZ‑I.

4B5B

4B5B maps each 4‑bit group to a 5‑bit code to ensure sufficient transitions for clock recovery. The mapping table is shown in Figure 6. This adds a 25 % overhead, requiring a 125 MHz clock for 100 Mbps transmission.

MLT‑3

MLT‑3 (Multi‑Level Transmit) uses three voltage levels (‑1, 0, +1). The voltage changes follow the rule: if the previous level is ‑1 or +1, the next level becomes 0; if the previous level is 0, the next level switches to the opposite non‑zero level, producing a sequence such as ‑1 → 0 → +1 or +1 → 0 → ‑1.

NRZ‑I

NRZ‑I (Non‑Return‑to‑Zero Inverted) defines that a logical “0” causes no transition, while a logical “1” causes a transition.

Combining these steps, the 100Base‑TX signal is first 4B5B‑encoded, then transmitted using MLT‑3 voltage levels, and finally XOR‑ed with a scrambler sequence generated by an 11‑bit LFSR. Figure 7 illustrates the decoding of three bytes.

The oscilloscope’s bus‑decode settings for 100Base‑TX are shown in Figure 8.

The final decoded packet (Figure 9) confirms successful extraction of the Ethernet frame.

Practical Verification

A small LAN of two computers was set up to ping each other. Wireshark captured ping request and reply packets (Figure 10). The oscilloscope was configured to trigger on the IP header of the source address 192.168.0.2 (Figure 11) and captured the corresponding packet (Figure 12), which matches the Wireshark capture.

Conclusion

Software‑centric network analysis often overlooks the physical layer, while hardware‑centric signal analysis rarely addresses complex Ethernet protocols. This work bridges that gap by using a mixed‑signal oscilloscope to decode Ethernet signals at the physical layer, demonstrating consistency between software‑captured packets and hardware‑captured waveforms.

References

[1] https://en.wikipedia.org/wiki/Ethernet

[2] https://en.wikipedia.org/wiki/ANSI/TIA-568

[3] https://www.wireshark.org

[4] https://en.wikipedia.org/wiki/4B5B

[5] https://en.wikipedia.org/wiki/MLT-3_encoding