ethetnet with snap header

Answered Question
May 7th, 2010

Hi every body.

I have few questions about Snap header in the 802.3 ethernet.

My book says"  another popular option exits for the protocol type field,particularly when sending ip packets. If the 802.3 type/length has a value less than 1536,the type/length field is used as length field for tthat frame,identifying the length of entire frame. In that case another field is needed to identify the type L3pdu inside the frame. "    Snap header is inserted the frame to identify the L3pdu.

My question is how common is it to find ethernet  with snap header carrying ip packets?  Most of the  ip packet i captured using wire shark,  use the  802.3  ethernet where type field is used to indicate the encapsulated ip packet.     Is it common for ip packets to use ethernet framing weith simply" type" field?

thanks  and have a nice weekend.

Correct Answer by Giuseppe Larosa about 6 years 9 months ago

Hello Sarah,

we probably had discussed this in some older thread

It is really difficult nowdays to find an IP packet encapsulated in an ethernet frame without using Eth II

The reason is that it is not efficient to use SNAP it adds a bigger overhead (up to 8 bytes overhead 3 bytes LLC 5 bytes SNAP 3 bytes oui + 2 bytes protocol type )

There are however some protocol messages that use this kind of encapsulation or similar

(these use only LLC header to be correct)

ISIS frames

ISO CLNP

STP IEEE standard BPDUs

Also SNA traffic use this kind of encapsulation (LLC encapsulation I mean, again to be correct)

so with some patience connecting to a LAN switch you could capture an STP frame and you could see the DSAP SSAP and other fields

So  your book may have reported a sentence from an older book or it is old itself

Edit:

in the following link you can see a list  of L2 signalling  protocols like CDP, VTP, DTP and they use SNAP

http://www.cisco.com/en/US/products/hw/switches/ps700/products_white_paper09186a00801b49a4.shtml

Have a nice weekend

Hope to help

Giuseppe

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Giuseppe Larosa Sat, 05/08/2010 - 01:43

Hello Sarah,

we probably had discussed this in some older thread

It is really difficult nowdays to find an IP packet encapsulated in an ethernet frame without using Eth II

The reason is that it is not efficient to use SNAP it adds a bigger overhead (up to 8 bytes overhead 3 bytes LLC 5 bytes SNAP 3 bytes oui + 2 bytes protocol type )

There are however some protocol messages that use this kind of encapsulation or similar

(these use only LLC header to be correct)

ISIS frames

ISO CLNP

STP IEEE standard BPDUs

Also SNA traffic use this kind of encapsulation (LLC encapsulation I mean, again to be correct)

so with some patience connecting to a LAN switch you could capture an STP frame and you could see the DSAP SSAP and other fields

So  your book may have reported a sentence from an older book or it is old itself

Edit:

in the following link you can see a list  of L2 signalling  protocols like CDP, VTP, DTP and they use SNAP

http://www.cisco.com/en/US/products/hw/switches/ps700/products_white_paper09186a00801b49a4.shtml

Have a nice weekend

Hope to help

Giuseppe

Actions

This Discussion