Solved: dix ethernet and IEEE original ethernet standard

sarahr202 · ‎06-04-2009

Hi every body!

According to my book,Dix ethernet frame v2 has following feilds:

Preamble

destination

source

type

data

fcs.

what value was used in" type"field to specify ip packet in data field?

======================================

My new book by Wendell Odom shows " IEEE 802.3(original)" standard as :

preamble

SFD

destination

source

length

data

fcs

IEEE replaced" type" field in Dix ethernet by " length"field in IEEE802.3 original standards.

My question is since there is no " type"

field,how the different pay load such as ip packet, ipx is supported over such standard.

The old book by Wendell Odom shows the IEEE 802.3 original standard as :

preamble

sd

dest address

sourceaddress

length

dsap

ssap

control

data

fcs.

The above has "dsap and ssap "fields to specify type of pay load which is not shown in IEEE 802.3 original in the new book.

Which one is correct?

thanks a lot !

Giuseppe Larosa · ‎06-04-2009

Hello Sarah,

nice question as usual.

My understanding is that the original length intended to carry the total frame size can become a protocol type when the value that is into it is bigger then the max ethernet size.

For example: IP over ethernet is

0x0800

if we convert this in decimal means:

2048 that is bigger then 1518 the original max ethernet frame size

(actually the link below says up to 1500 byte = 05DC)

So the trick is this:

values up to 0x 5dc are a real frame length values greater are protocol type.

see

http://standards.ieee.org/regauth/ethertype/eth.txt

0000 - 05DC IEEE802.3 Length Field

Hope to help

Giuseppe

View solution in original post

Giuseppe Larosa · ‎06-04-2009

Hello Sarah,

about the question of 802.3.

According to CCIE R&S 3edition

original 802.3 specification includes LLC header

a successive specification 802.3 in year 1997 has adopted the dix /Eth II format so in this case the LLC header (DSAP, SSAP and control) is missing.

So formally two different 802.3 specifications exist and in this context both books are right because they refer to the two versions of 802.3

It is confusing.

Hope to help

Giuseppe

View solution in original post

Laurent Aubert · ‎06-04-2009

802.3 specification stops at the length field so it's not incorrect to say it's only data following this field. It's 802.2 which takes care about how to determine to which upper layer I should send this frame.

So what the data field includes has not the same meaning if you explicit the LLC header or not. If the LLC header is not explicited, it means it's included in the data field.

Btw, could you give us the name of the books you are referring to ?

Thanks

Laurent.

View solution in original post

Giuseppe Larosa · ‎06-05-2009

Hello Sarah,

as also the book is saying the type/length type contains frame length only if its value can represent a valid frame length.

I'm not sure what is the exact boundary limit value but this looks like reasonable and enough to discriminate between the different formats.

if value < threshold then

(

the field is a length at at least LLC header follows, SNAP might be present if LLC = AA AA 03

)

else

(this is an ethertype and no LLC follows

)

This is my understanding.

Hope to help

Giuseppe

View solution in original post

Laurent Aubert · ‎06-05-2009

1) As I said 802.3 specification doesn't describe the full Data-link layer. you need 802.2 to have full implementation. That's why 100% of the original 802.3 frame before 1997 requires the LLC header.

2)Before 1997, you couldn't differentiate an Ethernet II frame from a 802.3 frame and so both formats couldn't co-exist

After 1997 as Giuseppe already explained both field had been merged and they made sure no overlapping can occur. Now both formats can be supported on the same LAN.

Laurent.

View solution in original post

Giuseppe Larosa · ‎06-06-2009

Hello Sarah,

I have my pc connected to an ADSL router here it is the txt of a capture while I was pinging a website

cat example_icmp1pack.txt

No. Time Source Destination Protocol Info

4 0.122055 213.92.16.191 192.168.2.2 ICMP Echo (ping) reply

Frame 4 (98 bytes on wire, 98 bytes captured)

Ethernet II, Src: 00:11:50:7e:c3:04, Dst: 00:0c:6e:d3:6c:45

Internet Protocol, Src Addr: 213.92.16.191 (213.92.16.191), Dst Addr: 192.168.2.2 (192.168.2.2)

Internet Control Message Protocol

Actually, for IPv4 ethernet format is used otherwise as you noted you should use :

LLC header (3 bytes)

+

SNAP header (5 bytes)

in last two bytes of SNAP the ethertype 0x800 should be used.

1997 802.3 revision simply accepts as a standard what had become standard in real world :

ethernet II format + IPv4 packet

if you check your PC you should see something similar:

ethernet II frame format with ethertype 0x800 and then the packet.

Here I put the hex dump of same packet

000 00 0c 6e d3 6c 45 00 11 50 7e c3 04 >>08 00<< 45 00 ..n.lE.. P~....E.

0010 00 54 c6 31 00 00 37 01 14 b2 d5 5c 10 bf c0 a8 .T.1..7. ...\....

0020 02 02 00 00 7c 1d a5 13 00 01 da ce 2a 4a e4 b1 ....|... ....*J..

as you can see after two MAC address ethertype 0800 follows the next byte has value 45 and it is the beginning of ipv4 header

Of course NAT allows my private ip address to reach the internet.

Hope to help

Giuseppe

View solution in original post

rais · ‎06-04-2009

IP/IPX etc. protocols still use Ethernet II. Protocols like STP uses 802.3

DSAP in 802.3 can contain type__ albiet fewer bits.

802.3 can be 'raw' or with LLC [802.2] header.

Thanks.

sarahr202 · ‎06-04-2009

Thanks for you reply Rais.

"IP/IPX etc. protocols still use Ethernet II"

1)What value "type" field in EthernetII contain for ip?

Right now my focus is to understand the IEEE802.3 original standard.

I have two cisco press books by Wendell Odom.

The new book shows "IEE802.3 original" standard as:

SFD

destination

source

length

data

fcs

The old book shows " IEEE802.3 original"

standard as:

preamble

sd

dest address

sourceaddress

length

dsap

ssap

control

data

fcs.

The difference is obvious. The old book shows DSAP, SSAp etc while new book shows only length field.My questions are:

1)which one is correct?

2)The new book shows " length" field in IEEE 802.3 original frame. Sincethere is no type field, how different pay load is supported?

Thanks and havea nice day!

Laurent Aubert · ‎06-04-2009

Hi,

Both are correct ;-). dsap,ssap and control field represent the 802.2 LLC header which follows the Length field of the 802.3 header.

From the 802.3 point of view, everything after the length field is seen as data.

From LLC point of view, everything after the control field is seen as data.

Just remember LLC header is always present in 802.3 frame.

HTH

Laurent.

sarahr202 · ‎06-04-2009

Thanks Lauret for your reply.

Sorry for repeating the same point.

The new book shows original 802.3 frame without dsap,ssap value. There is"length"field preceding the " data" field. In absence of " type" field, how will the receiving node distinguish between ip packet and ipx packet?

"Just remember LLC header is always present in 802.3 frame."

I don't see any llc header in the figure(IEEE802.3 original) shown in my new book .

my book shows only:

preamble

sfd

destination

source

length

data

fcs

thanks a lot and have a nice day!

Giuseppe Larosa · ‎06-04-2009

Hello Sarah,

nice question as usual.

My understanding is that the original length intended to carry the total frame size can become a protocol type when the value that is into it is bigger then the max ethernet size.

For example: IP over ethernet is

0x0800

if we convert this in decimal means:

2048 that is bigger then 1518 the original max ethernet frame size

(actually the link below says up to 1500 byte = 05DC)

So the trick is this:

values up to 0x 5dc are a real frame length values greater are protocol type.

see

http://standards.ieee.org/regauth/ethertype/eth.txt

0000 - 05DC IEEE802.3 Length Field

Hope to help

Giuseppe

Giuseppe Larosa · ‎06-04-2009

Hello Sarah,

about the question of 802.3.

According to CCIE R&S 3edition

original 802.3 specification includes LLC header

a successive specification 802.3 in year 1997 has adopted the dix /Eth II format so in this case the LLC header (DSAP, SSAP and control) is missing.

So formally two different 802.3 specifications exist and in this context both books are right because they refer to the two versions of 802.3

It is confusing.

Hope to help

Giuseppe

sarahr202 · ‎06-04-2009

Thanks Giuseppe!

I understand the whole story now.

But my book shows 802.3 original without llc header and shows 802.3 1997 specification with llc header.

Laurent Aubert · ‎06-04-2009

802.3 specification stops at the length field so it's not incorrect to say it's only data following this field. It's 802.2 which takes care about how to determine to which upper layer I should send this frame.

So what the data field includes has not the same meaning if you explicit the LLC header or not. If the LLC header is not explicited, it means it's included in the data field.

Btw, could you give us the name of the books you are referring to ?

Thanks

Laurent.

sarahr202 · ‎06-05-2009

Thanks Laurent.

Books:

CCNA intro by Wendel Odom,

isbn#1-58720-094-5

chapter# 3

ccent/ccna icnd1 by Wedel Odom,

isbn-13:978-1-58720-182-0

chapter#3

thanks and have a nice day.

sarahr202 · ‎06-05-2009

Thanks Lauret!

I am trying to understand the how the ethernet evolved.

First dix ethernet v1

dix ethernet v2

then IEEE 802.3 original

IEEE 802.3 revised 1997.

The lists goes on. But my goal is to understand stages dix v2 through IEEE802.3 revised 1997.

Here are issues :

1)IEEE 802.3 original:

The above specification replaced "type" by" length" field. In absence of how the different payloads are supported over 802.3 original standard.

Giuseppe pointed out how the length can be used to indicate the type of pay load or length of frame. But is it true for 802.3 original' " length field as well ?

Issue # 2

"So what the data field includes has not the same meaning if you explicit the LLC header or not. If the LLC header is not explicited, it means it's included in the data field."

Here is quote from my book about 802.3 1997 revised specifications:

For easy reference, i listed the fields for 802.3 1997 revised specification.

preamble

sfd

dest

source

length/type

data

fcs

" if the 802.3 type/length field has a value less than hex 0600(decimal 1536), the type/length field is used as a length field for that frame. In that case another field( LLCheader) is needed to identify the type of l3pdu in side the frame"

The above excerpt says the LLC header is only present when type/length field is used as a length field. It can be concluded when type/length field is used as a type, then llc header is not

needed.

I really appreciate all the responses , i received but i am still at loss.

thanks and have a nice day!

Giuseppe Larosa · ‎06-05-2009

Hello Sarah,

as also the book is saying the type/length type contains frame length only if its value can represent a valid frame length.

I'm not sure what is the exact boundary limit value but this looks like reasonable and enough to discriminate between the different formats.

if value < threshold then

(

the field is a length at at least LLC header follows, SNAP might be present if LLC = AA AA 03

)

else

(this is an ethertype and no LLC follows

)

This is my understanding.

Hope to help

Giuseppe

sarahr202 · ‎06-05-2009

Thanks Giuseppe and Laurent.

According to my book,

if Length/type< hex0600 (decimal 1536),

length/type field indicates length of frame.

please consider the 802.3 revised 1997 specification.

An ip packet carrying "ping" needs to be encapsulated in ethnernet frame. Since only ping is carried in ip packet, the size of ip packet will be a lot less than 1500 bytes. Consequently, the size of ethernet frame will be a lot less than 1536 bytes say 1200 bytes. under this situation , no llc will follow the length/type field. Moreover, Length/type will be used as type. Now what value length/type will contain to indicate ip packet in " data" field of ethernet frame.

thanks a lot !

Giuseppe Larosa · ‎06-06-2009

Hello Sara,

it is in the long list here

see

http://standards.ieee.org/regauth/ethertype/eth.txt

IPv4 ethertype = 0x 800

to be noted IPv6 has another ethetype.

To be mentioned also

802.1Q ethertype 0x8100

there are specific values for

MPLS

PPPoE (uses two ethertypes)

You can verify this by yourself by installing a free protocol analyzer like Wireshark on your pc.

http://www.wireshark.org/download.html

Hope to help

Giuseppe

sarahr202 · ‎06-06-2009

Hi Giuseppe!

Thanks for your reply. I mistyped my earlier question.

IEEE 802.3 1997 specification:

if length/type < 1536 bytes, then this field is used as length and thus llc header is needed. But for any ip packet, this " length/field " will always be used as "length" field never

as a" type". Because the max ip packet size,ethernet can carry is 1500 bytes. The resulting frame length will be 1500+ 30( frame over heads)= 1530 bytes which is less than 1536.

Therefore LLC header is needed to indicate the type. DSAp, ssap used in llc header to indicate the type has no reserved values for ip. That means 802.3 1997 can not carry ip packets.

Here is quote from my book;

" Interestingly, IEEE does not have a reserved DSAP value for tcp/ip, Snap header must be used to support tcp/ip over IEEE ethernet."

Based on the above, only IEEE 802.3 with snap header, can support tcp/ip .

=================================

http://en.wikipedia.org/wiki/IEEE_802.3

Quote from the above link;

"ethernet II

(DIX v2.0) 1982 10 Mbit/s (1.25 MB/s) over thin coax (thinnet) - Frames have a Type field. thernet II

(DIX v2.0) 1982 10 Mbit/s (1.25 MB/s) over thin coax (thinnet) - Frames have a Type field. This frame format is used on all forms of Ethernet by protocols in the Internet protocol suite.

The only IEEE standard that takes dix II format is 802.3 1997 that too when length/type field is used as" type" which is not possible for tcp/ip .

My pc is using fast ethernet which is iEEE standard. That means my nic is using 802.3 with snap header .

But the link above says

dix v2, his frame format is used on all forms of Ethernet by protocols in the Internet protocol suite.

Thanks a lot!