Back to Basics: Ethernet

Unanswered Question
Oct 26th, 2009


I'm just getting confused again after several years of networking. I'm getting back to the topics about Ethernet and the standards. I'm getting confused right now with the Ethernet types. Yeah I know Cisco switches and routers use ARPA which is also called Ethernet II. But going back to the drawing board, how did it all start? It's really confusing that things like 802.3 and 802.2LLC came out. What's the history of these things? After doing things like packet sniffing using Ethereal, I just saw Ethernet II. Source and Destination which consists of 12bytes plus 2bytes Type field and 4 bytes FCS so a total of 18bytes.

What is also the difference between show interface MTU and show ip interface MTU on a Cisco device? they both show 1500bytes. I want to be clear with these things again before I jump into my studies with MPLS because it discusses a lot with frame sizes. Thanks in advance guys.


I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (3 ratings)
Peter Paluch Mon, 10/26/2009 - 12:17

Hello John,

From what I have been able to dig out and remember, the first version of Ethernet frame was used in 1970/early 1980s but it was soon replaced by the Ethernet II which is the DIX version. In other words, the DIX is the Ethernet II.

However, as the IEEE got its hands on standardizing the frame, they have made subtle changes to it, no doubt being motivated by other frame formats they have been very familiar with, namely the HDLC. So the IEEE 802.3 basic frame format came out in 1980s which basically just split the DIX preamble (8B) to preamble (7B) and start-of-frame delimiter (1B) and the DIX Type field was renamed to Length. The 802.3 LLC subsequently defined the DSAP, SSAP and Control fields, each being 1B long.

Now, the IEEE had a workable frame format but it soon became obvious that it is very limiting. Having two fields, DSAP and SSAP, is kind of weird - usually you expect that the frame shall be processed by the same protocol that has originated it. Still, the IEEE decided to go with the Source and Destination SAP being independent. More serious, however, was the limited range of SAP values - only 256 were available. A wonderful curiosity here is that the IP protocol actually has its official SAP value - it is 0x06 - but the ARP has not been assigned any official SAP value so it is not in fact possible to run IP over 802.3 LLC Ethernet because you are not able to send ARP packets in 802.3 frames :-) Check this listing:

This problem was somewhat remedied by IEEE later defining the 802.2 LLC SNAP header that added yet another 5B of overhead. The first 3B are the OUI of the protocol author and the remaining 2B are basically the Type field. So with overwhelming 8B of overhead you get basically the same what you have with a simple DIX frame :)

I also heartily recommend reading this page:

Best regards,


John Patrick Lopez Mon, 10/26/2009 - 13:08

Thanks for the reply sir. The last URL is very good. So basically, this is how I understood things.

IEEE 802.3 = is the frame format with 802.3 and 802.2 LLC. Uses Length field instead of Type.

Ethernet II = basically the same thing as Ethernet and called DIX. Uses Type instead of Length. Used in all implementations of Ethernet nowadays.

802.3 SNAP = is an 802.3 frame with 802.2LLC and SNAP header

802.3 Raw = Pure 802.3 frame using Length instead of Type

Please correct if something is wrong. =)

Peter Paluch Mon, 10/26/2009 - 13:38

Hello John,

Yes, you understand it in the same way as I do. The 802.3 Raw is basically a Novell-specific frame made of half-baked 802.3 specification that was not yet finished when Novell decided to stick with it. Its specialty is that it does not use the DSAP/SSAP/Control bytes and is recognizable by the value 0xFFFF where the DSAP/SSAP bytes should be found. It's not used in this form anymore.

Best regards,


Giuseppe Larosa Mon, 10/26/2009 - 14:04

Hello John,

in the revised 802.3 standard (1998) IEEE acknowledged the great success of EthII/DIX.

you can still find some examples of frames using 802.2 LLC like IEEE STP frames and IS-IS frames but they are rare in comparison with total number of EthII frames.

Hope to help



This Discussion