Unlike 8b/10b and 64b/67b, 64b/66b relies entirely on the scrambler for ensuring DC balance. This raises the question: can a malicious data stream force the line to leave DC balance? Or would it need access to information that is not exposed by the NIC?


Yes, absolutely. The scrambler produces 64 bits of output from 64 bits of input, which means there 1:1 mapping of inputs and outputs, and thus there is an input which produces all 1's as output. The preamble will force a single "0" every frame, but still, the DC balance will be way off.

As for the state, the scrambler is self-synchronous based on in-band data, and requires 64 frames to synchronize. Which means if you send 64 sequential frames (512 bytes of data), you will know the exact scrambler state. This is trivial to achieve -- just send a single long ethernet packet.

  • \$\begingroup\$ What I have read is that it is not possible for a single packet to jam the scrambler with 1 packet. Is there any data transmitted between packets that is not part of any packet nor set to a predictable value? \$\endgroup\$ – Demi Sep 8 '18 at 17:00

According to IEEE-802.3:

Section 49.2.6 Scrambler: To aid block synchronization in the receiver for EEE capability when Clause 74 FEC is in use, when scrambler_bypass is TRUE the PCS shall pass the unscrambled data from the scrambler input rather than the scrambled data from the scrambler output. The scrambler shall continue to advance normally.

So, you can bypass the scrambler. If you do that, you certainly can affect DC balance.

Section 50.3.3 Scrambling: The use of the scrambler is intended to provide for DC balance (i.e. an equal number of 1’s and 0’s on average) and for sufficient transition density within the bit stream transmitted on the medium.

So, if you use the scrambler, you have to (somehow?) manipulate the transfer function: G(x) = 1 + x^39 + x^58 to manipulate DC balance.

Maybe you knew the latter based on your question, but, maybe you didn't know you could bypass the scrambler(?)... albeit, do you have access to the setting? Mostly, just trying to share IEEE-802.3 relevant information that you might not have otherwise.

found this too:

scr_bypass_enable: A Boolean variable used to indicate to the transmit LPI state diagram that the scrambler bypass option is required. The PHY shall set scr_bypass_enable = TRUE if Clause 74 FEC is in use. The PHY shall set scr_bypass_enable = FALSE if this FEC is not in use.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.