×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

Spanning Tree header value

Unanswered Question
May 17th, 2012
User Badges:
  • Silver, 250 points or more

Hi all,


I am sniffing packets and I am trying to identify Spanning Tree Packets.

Do you know if there a field identifier to the STP packets/header?


Thank you,

Vasilis

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Giuseppe Larosa Thu, 05/17/2012 - 03:57
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

Hello Vasilis,

first of all, we have to note that encapsulation of PVST+ is totally different then standard IEEE 802.1D STP.


You can find very useful information about STP encapsulation and those of other protocols like CDP, DTP, VTP and so on in a document present in CCO named "best practices for IOS based switches"

see

http://www.cisco.com/en/US/products/hw/switches/ps708/products_white_paper09186a00801b49a4.shtml



IEEE 802.1D encapsulation has the LLC header with SSAP= DSAP = 42 with a well known L2 MAC multicast destination of

01-80-c2-00-00-00


Cisco PVST+  uses LLC SNAP encapsulation with LLC= 0x AAAA03 + 3bytes Cisco OUI= 0x00000C+ 0x010b as HDLC 2 byte protocol type with a multicast MAC destination of

01-00-0c-cc-cc-cd


To be noted on an access port a Cisco switch should use the IEEE version of the BPDU and the proprietary version is used over trunk ports


Hope to help

Giuseppe



Edit:

I have attached the pdf version of the document

Actions

This Discussion

Related Content