06-04-2009 07:48 AM - edited 03-06-2019 06:06 AM
Hi every body!
According to my book,Dix ethernet frame v2 has following feilds:
Preamble
destination
source
type
data
fcs.
what value was used in" type"field to specify ip packet in data field?
======================================
My new book by Wendell Odom shows " IEEE 802.3(original)" standard as :
preamble
SFD
destination
source
length
data
fcs
IEEE replaced" type" field in Dix ethernet by " length"field in IEEE802.3 original standards.
My question is since there is no " type"
field,how the different pay load such as ip packet, ipx is supported over such standard.
The old book by Wendell Odom shows the IEEE 802.3 original standard as :
preamble
sd
dest address
sourceaddress
length
dsap
ssap
control
data
fcs.
The above has "dsap and ssap "fields to specify type of pay load which is not shown in IEEE 802.3 original in the new book.
Which one is correct?
thanks a lot !
Solved! Go to Solution.
06-04-2009 11:27 AM
Hello Sarah,
nice question as usual.
My understanding is that the original length intended to carry the total frame size can become a protocol type when the value that is into it is bigger then the max ethernet size.
For example: IP over ethernet is
0x0800
if we convert this in decimal means:
2048 that is bigger then 1518 the original max ethernet frame size
(actually the link below says up to 1500 byte = 05DC)
So the trick is this:
values up to 0x 5dc are a real frame length values greater are protocol type.
see
http://standards.ieee.org/regauth/ethertype/eth.txt
0000 - 05DC IEEE802.3 Length Field
Hope to help
Giuseppe
06-04-2009 12:15 PM
Hello Sarah,
about the question of 802.3.
According to CCIE R&S 3edition
original 802.3 specification includes LLC header
a successive specification 802.3 in year 1997 has adopted the dix /Eth II format so in this case the LLC header (DSAP, SSAP and control) is missing.
So formally two different 802.3 specifications exist and in this context both books are right because they refer to the two versions of 802.3
It is confusing.
Hope to help
Giuseppe
06-04-2009 12:35 PM
802.3 specification stops at the length field so it's not incorrect to say it's only data following this field. It's 802.2 which takes care about how to determine to which upper layer I should send this frame.
So what the data field includes has not the same meaning if you explicit the LLC header or not. If the LLC header is not explicited, it means it's included in the data field.
Btw, could you give us the name of the books you are referring to ?
Thanks
Laurent.
06-05-2009 08:29 AM
Hello Sarah,
as also the book is saying the type/length type contains frame length only if its value can represent a valid frame length.
I'm not sure what is the exact boundary limit value but this looks like reasonable and enough to discriminate between the different formats.
if value < threshold then
(
the field is a length at at least LLC header follows, SNAP might be present if LLC = AA AA 03
)
else
(this is an ethertype and no LLC follows
)
This is my understanding.
Hope to help
Giuseppe
06-05-2009 09:07 AM
1) As I said 802.3 specification doesn't describe the full Data-link layer. you need 802.2 to have full implementation. That's why 100% of the original 802.3 frame before 1997 requires the LLC header.
2)Before 1997, you couldn't differentiate an Ethernet II frame from a 802.3 frame and so both formats couldn't co-exist
After 1997 as Giuseppe already explained both field had been merged and they made sure no overlapping can occur. Now both formats can be supported on the same LAN.
Laurent.
06-06-2009 10:32 AM
Hello Sarah,
I have my pc connected to an ADSL router here it is the txt of a capture while I was pinging a website
cat example_icmp1pack.txt
No. Time Source Destination Protocol Info
4 0.122055 213.92.16.191 192.168.2.2 ICMP Echo (ping) reply
Frame 4 (98 bytes on wire, 98 bytes captured)
Ethernet II, Src: 00:11:50:7e:c3:04, Dst: 00:0c:6e:d3:6c:45
Internet Protocol, Src Addr: 213.92.16.191 (213.92.16.191), Dst Addr: 192.168.2.2 (192.168.2.2)
Internet Control Message Protocol
Actually, for IPv4 ethernet format is used otherwise as you noted you should use :
LLC header (3 bytes)
+
SNAP header (5 bytes)
in last two bytes of SNAP the ethertype 0x800 should be used.
1997 802.3 revision simply accepts as a standard what had become standard in real world :
ethernet II format + IPv4 packet
if you check your PC you should see something similar:
ethernet II frame format with ethertype 0x800 and then the packet.
Here I put the hex dump of same packet
000 00 0c 6e d3 6c 45 00 11 50 7e c3 04 >>08 00<< 45 00 ..n.lE.. P~....E.
0010 00 54 c6 31 00 00 37 01 14 b2 d5 5c 10 bf c0 a8 .T.1..7. ...\....
0020 02 02 00 00 7c 1d a5 13 00 01 da ce 2a 4a e4 b1 ....|... ....*J..
as you can see after two MAC address ethertype 0800 follows the next byte has value 45 and it is the beginning of ipv4 header
Of course NAT allows my private ip address to reach the internet.
Hope to help
Giuseppe
06-04-2009 11:05 AM
IP/IPX etc. protocols still use Ethernet II. Protocols like STP uses 802.3
DSAP in 802.3 can contain type__ albiet fewer bits.
802.3 can be 'raw' or with LLC [802.2] header.
Thanks.
06-04-2009 11:25 AM
Thanks for you reply Rais.
"IP/IPX etc. protocols still use Ethernet II"
1)What value "type" field in EthernetII contain for ip?
Right now my focus is to understand the IEEE802.3 original standard.
I have two cisco press books by Wendell Odom.
The new book shows "IEE802.3 original" standard as:
SFD
destination
source
length
data
fcs
The old book shows " IEEE802.3 original"
standard as:
preamble
sd
dest address
sourceaddress
length
dsap
ssap
control
data
fcs.
The difference is obvious. The old book shows DSAP, SSAp etc while new book shows only length field.My questions are:
1)which one is correct?
2)The new book shows " length" field in IEEE 802.3 original frame. Sincethere is no type field, how different pay load is supported?
Thanks and havea nice day!
06-04-2009 11:20 AM
Hi,
Both are correct ;-). dsap,ssap and control field represent the 802.2 LLC header which follows the Length field of the 802.3 header.
From the 802.3 point of view, everything after the length field is seen as data.
From LLC point of view, everything after the control field is seen as data.
Just remember LLC header is always present in 802.3 frame.
HTH
Laurent.
06-04-2009 11:39 AM
Thanks Lauret for your reply.
Sorry for repeating the same point.
The new book shows original 802.3 frame without dsap,ssap value. There is"length"field preceding the " data" field. In absence of " type" field, how will the receiving node distinguish between ip packet and ipx packet?
"Just remember LLC header is always present in 802.3 frame."
I don't see any llc header in the figure(IEEE802.3 original) shown in my new book .
my book shows only:
preamble
sfd
destination
source
length
data
fcs
thanks a lot and have a nice day!
06-04-2009 11:27 AM
Hello Sarah,
nice question as usual.
My understanding is that the original length intended to carry the total frame size can become a protocol type when the value that is into it is bigger then the max ethernet size.
For example: IP over ethernet is
0x0800
if we convert this in decimal means:
2048 that is bigger then 1518 the original max ethernet frame size
(actually the link below says up to 1500 byte = 05DC)
So the trick is this:
values up to 0x 5dc are a real frame length values greater are protocol type.
see
http://standards.ieee.org/regauth/ethertype/eth.txt
0000 - 05DC IEEE802.3 Length Field
Hope to help
Giuseppe
06-04-2009 12:15 PM
Hello Sarah,
about the question of 802.3.
According to CCIE R&S 3edition
original 802.3 specification includes LLC header
a successive specification 802.3 in year 1997 has adopted the dix /Eth II format so in this case the LLC header (DSAP, SSAP and control) is missing.
So formally two different 802.3 specifications exist and in this context both books are right because they refer to the two versions of 802.3
It is confusing.
Hope to help
Giuseppe
06-04-2009 12:32 PM
Thanks Giuseppe!
I understand the whole story now.
But my book shows 802.3 original without llc header and shows 802.3 1997 specification with llc header.
06-04-2009 12:35 PM
802.3 specification stops at the length field so it's not incorrect to say it's only data following this field. It's 802.2 which takes care about how to determine to which upper layer I should send this frame.
So what the data field includes has not the same meaning if you explicit the LLC header or not. If the LLC header is not explicited, it means it's included in the data field.
Btw, could you give us the name of the books you are referring to ?
Thanks
Laurent.
06-05-2009 06:41 AM
Thanks Laurent.
Books:
CCNA intro by Wendel Odom,
isbn#1-58720-094-5
chapter# 3
ccent/ccna icnd1 by Wedel Odom,
isbn-13:978-1-58720-182-0
chapter#3
thanks and have a nice day.
06-05-2009 07:17 AM
Thanks Lauret!
I am trying to understand the how the ethernet evolved.
First dix ethernet v1
dix ethernet v2
then IEEE 802.3 original
IEEE 802.3 revised 1997.
The lists goes on. But my goal is to understand stages dix v2 through IEEE802.3 revised 1997.
Here are issues :
1)IEEE 802.3 original:
The above specification replaced "type" by" length" field. In absence of how the different payloads are supported over 802.3 original standard.
Giuseppe pointed out how the length can be used to indicate the type of pay load or length of frame. But is it true for 802.3 original' " length field as well ?
Issue # 2
"So what the data field includes has not the same meaning if you explicit the LLC header or not. If the LLC header is not explicited, it means it's included in the data field."
Here is quote from my book about 802.3 1997 revised specifications:
For easy reference, i listed the fields for 802.3 1997 revised specification.
preamble
sfd
dest
source
length/type
data
fcs
" if the 802.3 type/length field has a value less than hex 0600(decimal 1536), the type/length field is used as a length field for that frame. In that case another field( LLCheader) is needed to identify the type of l3pdu in side the frame"
The above excerpt says the LLC header is only present when type/length field is used as a length field. It can be concluded when type/length field is used as a type, then llc header is not
needed.
I really appreciate all the responses , i received but i am still at loss.
thanks and have a nice day!
06-05-2009 08:29 AM
Hello Sarah,
as also the book is saying the type/length type contains frame length only if its value can represent a valid frame length.
I'm not sure what is the exact boundary limit value but this looks like reasonable and enough to discriminate between the different formats.
if value < threshold then
(
the field is a length at at least LLC header follows, SNAP might be present if LLC = AA AA 03
)
else
(this is an ethertype and no LLC follows
)
This is my understanding.
Hope to help
Giuseppe
06-05-2009 10:51 AM
Thanks Giuseppe and Laurent.
According to my book,
if Length/type< hex0600 (decimal 1536),
length/type field indicates length of frame.
please consider the 802.3 revised 1997 specification.
An ip packet carrying "ping" needs to be encapsulated in ethnernet frame. Since only ping is carried in ip packet, the size of ip packet will be a lot less than 1500 bytes. Consequently, the size of ethernet frame will be a lot less than 1536 bytes say 1200 bytes. under this situation , no llc will follow the length/type field. Moreover, Length/type will be used as type. Now what value length/type will contain to indicate ip packet in " data" field of ethernet frame.
thanks a lot !
06-06-2009 06:40 AM
Hello Sara,
it is in the long list here
see
http://standards.ieee.org/regauth/ethertype/eth.txt
IPv4 ethertype = 0x 800
to be noted IPv6 has another ethetype.
To be mentioned also
802.1Q ethertype 0x8100
there are specific values for
MPLS
PPPoE (uses two ethertypes)
You can verify this by yourself by installing a free protocol analyzer like Wireshark on your pc.
http://www.wireshark.org/download.html
Hope to help
Giuseppe
06-06-2009 09:59 AM
Hi Giuseppe!
Thanks for your reply. I mistyped my earlier question.
IEEE 802.3 1997 specification:
if length/type < 1536 bytes, then this field is used as length and thus llc header is needed. But for any ip packet, this " length/field " will always be used as "length" field never
as a" type". Because the max ip packet size,ethernet can carry is 1500 bytes. The resulting frame length will be 1500+ 30( frame over heads)= 1530 bytes which is less than 1536.
Therefore LLC header is needed to indicate the type. DSAp, ssap used in llc header to indicate the type has no reserved values for ip. That means 802.3 1997 can not carry ip packets.
Here is quote from my book;
" Interestingly, IEEE does not have a reserved DSAP value for tcp/ip, Snap header must be used to support tcp/ip over IEEE ethernet."
Based on the above, only IEEE 802.3 with snap header, can support tcp/ip .
=================================
http://en.wikipedia.org/wiki/IEEE_802.3
Quote from the above link;
"ethernet II
(DIX v2.0) 1982 10 Mbit/s (1.25 MB/s) over thin coax (thinnet) - Frames have a Type field. thernet II
(DIX v2.0) 1982 10 Mbit/s (1.25 MB/s) over thin coax (thinnet) - Frames have a Type field. This frame format is used on all forms of Ethernet by protocols in the Internet protocol suite.
The only IEEE standard that takes dix II format is 802.3 1997 that too when length/type field is used as" type" which is not possible for tcp/ip .
My pc is using fast ethernet which is iEEE standard. That means my nic is using 802.3 with snap header .
But the link above says
dix v2, his frame format is used on all forms of Ethernet by protocols in the Internet protocol suite.
Thanks a lot!
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide