cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
2213
Views
0
Helpful
2
Replies

ethetnet with snap header

sarahr202
Level 5
Level 5

Hi every body.

I have few questions about Snap header in the 802.3 ethernet.

My book says"  another popular option exits for the protocol type field,particularly when sending ip packets. If the 802.3 type/length has a value less than 1536,the type/length field is used as length field for tthat frame,identifying the length of entire frame. In that case another field is needed to identify the type L3pdu inside the frame. "    Snap header is inserted the frame to identify the L3pdu.

My question is how common is it to find ethernet  with snap header carrying ip packets?  Most of the  ip packet i captured using wire shark,  use the  802.3  ethernet where type field is used to indicate the encapsulated ip packet.     Is it common for ip packets to use ethernet framing weith simply" type" field?

thanks  and have a nice weekend.

1 Accepted Solution

Accepted Solutions

Giuseppe Larosa
Hall of Fame
Hall of Fame

Hello Sarah,

we probably had discussed this in some older thread

It is really difficult nowdays to find an IP packet encapsulated in an ethernet frame without using Eth II

The reason is that it is not efficient to use SNAP it adds a bigger overhead (up to 8 bytes overhead 3 bytes LLC 5 bytes SNAP 3 bytes oui + 2 bytes protocol type )

There are however some protocol messages that use this kind of encapsulation or similar

(these use only LLC header to be correct)

ISIS frames

ISO CLNP

STP IEEE standard BPDUs

Also SNA traffic use this kind of encapsulation (LLC encapsulation I mean, again to be correct)

so with some patience connecting to a LAN switch you could capture an STP frame and you could see the DSAP SSAP and other fields

So  your book may have reported a sentence from an older book or it is old itself

Edit:

in the following link you can see a list  of L2 signalling  protocols like CDP, VTP, DTP and they use SNAP

http://www.cisco.com/en/US/products/hw/switches/ps700/products_white_paper09186a00801b49a4.shtml

Have a nice weekend

Hope to help

Giuseppe

View solution in original post

2 Replies 2

Giuseppe Larosa
Hall of Fame
Hall of Fame

Hello Sarah,

we probably had discussed this in some older thread

It is really difficult nowdays to find an IP packet encapsulated in an ethernet frame without using Eth II

The reason is that it is not efficient to use SNAP it adds a bigger overhead (up to 8 bytes overhead 3 bytes LLC 5 bytes SNAP 3 bytes oui + 2 bytes protocol type )

There are however some protocol messages that use this kind of encapsulation or similar

(these use only LLC header to be correct)

ISIS frames

ISO CLNP

STP IEEE standard BPDUs

Also SNA traffic use this kind of encapsulation (LLC encapsulation I mean, again to be correct)

so with some patience connecting to a LAN switch you could capture an STP frame and you could see the DSAP SSAP and other fields

So  your book may have reported a sentence from an older book or it is old itself

Edit:

in the following link you can see a list  of L2 signalling  protocols like CDP, VTP, DTP and they use SNAP

http://www.cisco.com/en/US/products/hw/switches/ps700/products_white_paper09186a00801b49a4.shtml

Have a nice weekend

Hope to help

Giuseppe

Thanks Giusepppe. you too have a nice weekend.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco