Ethernet Page
This page last updated May 14, 2007
Back to Bill Alexander's Home page
Free Network Sniffer for Windows and Linux: http://www.ethereal.com
Very good information on Ethernet: http://en.wikipedia.org/wiki/Ethernet
Ethernet Frame Formats:
Ethernet (a.k.a. Ethernet II)
+---------+---------+---------+----------
| Dst | Src | Type | Data...
+---------+---------+---------+----------
<-- 6 --> <-- 6 --> <-- 2 --> <-46-1500->
Type 0x80 0x00 = TCP/IP
Type 0x06 0x00 = XNS
Type 0x81 0x37 = Novell NetWare
802.3
+---------+---------+---------+----------
| Dst | Src | Length | Data...
+---------+---------+---------+----------
<-- 6 --> <-- 6 --> <-- 2 --> <-46-1500->
802.2 (802.3 with 802.2 header)
+---------+---------+---------+-------+-------+-------+----------
| Dst | Src | Length | DSAP | SSAP |Control| Data...
+---------+---------+---------+-------+-------+-------+----------
<- 1 -> <- 1 -> <- 1 -> <-43-1497->
SNAP (802.3 with 802.2 and SNAP headers)
+---------+---------+---------+-------+-------+-------+-----------+---------+-----------
| Dst | Src | Length | 0xAA | 0xAA | 0x03 | Org Code | Type | Data...
+---------+---------+---------+-------+-------+-------+-----------+---------+-----------
<-- 3 --> <-- 2 --> <-38-1492->
At the physical layer, the Dst
field is preceded by a 7-byte preamble and a 1-byte start of frame delimiter.
At the end of the Data field is a 4 byte checksum. So, the minimum and maximum
frame sizes on Ethernet are:
|
Field Name
|
Min Size
|
Max Size
|
Min w/o Preamble
|
Max w/o Preamble
|
|
Preamble
|
7
|
7
|
|
|
|
Start of frame delimiter
|
1
|
1
|
|
|
|
Dst
|
6
|
6
|
6
|
6
|
|
Src
|
6
|
6
|
6
|
6
|
|
Type/Length
|
2
|
2
|
2
|
2
|
|
Data
|
46
|
1500
|
46
|
1500
|
|
Checksum
|
4
|
4
|
4
|
4
|
|
Total
|
72
|
1526
|
64
|
1518
|
Dst is a 6-byte
destination address.
Src is a 6-byte source address.
For Ethernet II frames, Type is the protocol type of the packet. 0x80 0x00 is
TCP/IP, etc...
For 802.3 frames, Length is the number of bytes in the Data field.
Ethernet uses the type field to determine the packet protocol. 802.3/802.2 use the DSAP and SSAP fields.
Since there are only 256 possible SAP values, they are fairly hard to get.
The special SAP number of 0xAA was assigned to indicate that there are further
headers after the 802.2 header that must be parsed to determine the network
level protocol. This is the SNAP header which uses the same type field used by
V2 Ethernet.
For its Ethernet_802.3 packet format, Novell uses the 802.3 frame type
without adding an IEEE 802.2 LLC header (in this case, NetWare adds its own
proprietary higher-level information). This type of packet can be called an
802.3 Raw format. NetWare's 802.3 format
is the only CSMA/CD packet type that doesn't incorporate a corresponding
standard header for logical-link control or data-link control information.
While this may seem to make Ethernet II and IEEE 802.3 packets incompatible on
the same wire, they can coexist quite well. This is possible due to the
1,518-byte limit (destination address field to checksum field) on the size of
an Ethernet or 802.3 frame and the fact that all
Ethernet II Frame Types (assigned and managed by Xerox) are values greater than
1,500 decimal (i.e. the maximum value that can appear in the 802.3 type/length
field). Thus, if a packet has a value of 1,500 decimal (05 DC hexadecimal) or
less in byte positions 13 to 14, it will be considered an 802.3 packet.
Ethernet II uses one bit to indicate multicast addresses, 802.3 uses two
bits. On 802.3, the first bit is similar to the multicast bit in that it
indicates whether the address is for an individual or for a group, and the
second bit indicates whether the address is locally or universally assigned.
The second bit is rarely used on Ethernet (CSMA/CD) networks.
In Novell's 802.3 Raw format, the Data field begins
with IPX header information. The first two bytes in this header (for this
format) are always hexadecimal FF FF. These two bytes
help confirm that an 802.3 Raw packet contains encapsulated IPX information,
but they correspond to IPX's Checksum field. Because
this static information interferes with use of the IPX Checksum field, 802.3 Raw packets will not be able to use the security features,
such as packet signing, planned for the IPX format. Packets incorporating 802.2 link information are free to use the IPX Checksum
feature. Note that IEEE does not recognize Novell's 802.3 Raw format; it
recognizes only 802.3 packets encoded with 802.2 and 802.2 SNAP headers.
Adding IEEE 802.2 LLC information to an 802.3 physical packet format
requires three additional fields at the beginning of the Data field: a one-byte
Destination Service Access Point (DSAP) field, a one-byte Source Service Access
Point (SSAP) field, and a one-byte Control field. IEEE assigns Service Access
Point numbers (SAPs); among those currently defined
are E0 for Novell, F0 for NetBIOS, 06 for TCP/IP, and
AA for the Subnetwork Access Protocol (SNAP). NetWare
packets using the Ethernet_802.2 format have DSAP and SSAP values of E0, and
the Control field is set to 03 (denoting the 802.2 unnumbered format).
Examples:
IP on an "Ethernet" can be indicated by Ethernet V2 type 0x0800,
802.2 SAP code 0x06, or a SAP code of 0xAA followed by
a SNAP type code of 0x0800.
AppleTalk can be indicated by either Ethernet V2 type 0x809B (Phase I), or a
SAP code of 0xAA followed by a SNAP type code of 0x809B (Phase II). AppleTalk
is currently never sent as an 802.3/802.2 packet with a unique SAP code.
Novell can be found as either Ethernet type 0x8137, or a raw 802.3 packet.
It is not sent as an 802.3/802.2 packet with a unique SAP code.
There are only a few SAP values that you are likely to run across. They are:
04 - IBM SNA
06 - IP
80 - 3Com
AA - SNAP
BC - Banyan
E0 - Novell (TR)
F4 - Lan Manager FE - CLNS
100BaseT is the IEEE specification for the 100-Mbps Ethernet implementation
over unshielded twisted-pair (UTP) and shielded twisted-pair (STP) cabling. The
Media Access Control (MAC) layer is compatible with the IEEE 802.3 MAC layer.
100VG-AnyLAN is an IEEE specification for 100-Mbps Token Ring and Ethernet
implementations over 4-pair UTP. The MAC layer is not compatible with the IEEE
802.3 MAC layer. 100VG-AnyLAN was developed by Hewlett-Packard (HP) to support
newer time-sensitive applications, such as multimedia. A version of HP's implementation is standardized in the IEEE 802.12
specification.
History of this page:
April 3, 2002 – created with information from various sources.
May 14, 2007 – corrected error concerning the type/length
field in 802.3 packets. Thanks to
Anoop Ghanwani, Jian Liu, Ming Louie, and Anamaya
Sullerey.