Ethernet frame and IEEE 802.3 Frame

Http://zhidao.baidu.com/question/93567501.html

Http://blog.csdn.net/wzw200/archive/2009/07/23/4373056.aspx

 

Ethernet frame format

I. Development of Ethernet frame formats

1980 Dec, Intel, and Xerox have developed Ethernet I standards
1982 Dec, Intel, and Xerox have developed standards for ew.net II
1982 IEEE started to study the International Ethernet standard 802.3
Novell 1983 can't wait to develop a dedicated Ethernet frame format based on the original version of IEEE 802.3
1985 IEEE introduced the IEEE 802.3 specification. Later, to solve the compatibility problem between ethernetii and the 802.3 frame format,
Introduced a compromise Ethernet SNAP format

(The early Ethernet I has been completely replaced by other frame formats, so now Ethernet can only see the following several Ethernet frame formats,
Most network devices now support these Ethernet frame formats,
For example, when a Cisco router sets an Ethernet interface, you can specify different Ethernet frame formats: ARPA, SAP, snap, and Novell-ether)

Ii. Various frame formats
The following describes the formats of frames.
1. Ethernet II
Dix Ethernet Alliance launched .... It consists of 6 bytes of the destination MAC address, 6 bytes of the source MAC address,
The two-byte type fields (used to indicate the Data Type encapsulated in this frame) are frame headers,
Next we will check the data of-bytes and the frame of 4 bytes.
2. Novell Ethernet
Its frame header is different from Ethernet. The type field in the ethernetii frame header is changed to the length field,
The next two bytes are 0 xFFFF, which indicates that the frame is a frame of the Novell ether type,
Because the above 0xffff station drops two bytes, the data domain is reduced to 44-1498 bytes, and the frame verification remains unchanged.
3. IEEE 802.3/802.2
The frame header of 802.3 is different from the frame header of Ethernet II, and the ethernetii type domain is changed to the length domain.
The 802.2 protocol (LLC) is introduced to add an LLC header after the 802.3 frame header,
By DSAP (destination Service Access Point) 1 byte, SSAP (source SAP), a control domain-1 byte! SAP is the upper layer protocol used to mark frames.

4. Ethernet SNAP
The biggest difference between a snap frame and a 802.3/802.2 frame is that a 5-bytes snap ID is added.
The first three bytes are generally the same as the first three bytes of the source MAC address!
Sometimes it can be set to 0, and the last 2 bytes is the same as the type domain of Ethernet II...

3. How to differentiate different frame formats

How do network devices of the four frames in Ethernet be identified? How to distinguish ethernetii from three other formats of Frame
If the 2 bytes value of the frame header following the source MAC address is greater than 1500, the frame is in ethernetii format.

Then compare the following two bytes. If it is 0xffff, It is a frame of the Novell ether type,
If 0xaaaa is used, it is a frame in the format of Ethernet SNAP. If not, it is a frame in the format of Ethernet 802.3/802.2.

Several Ethernet frame formats

 
I haven't figured out a basic problem for a long time-the Encapsulation Format of Ethernet. I recently checked the relevant documents and summarized them as follows;
 
First, let's explain that Ethernet and 802.3 are not the same thing, although we often mix these two terms;
 
There are five historical Ethernet frame formats:
 
1. Ethernet V1: This is the most primitive format. It is a 3 Mbps CSMA/CD Ethernet standard Encapsulation Format proposed by Xerox PARC,
Later, in 1980, the Ethernet V1 standard was standardized by DEC, Intel, and Xerox;
 
2. Ethernet V2 (ARPA): This is the most common Ethernet frame format and is also the de facto standard for Ethernet today,
The standards released by DEC, Intel, and Xerox in 1982 mainly changed the electrical characteristics and physical interfaces of Ethernet V1,
There is no change in the frame format; after the emergence of Ethernet V2, it quickly replaces Ethernet V1 as the de facto Ethernet standard;
The frame header structure of Ethernet V2 is 6 bytes source address + 6 bytes target address + 2 bytes protocol type field + data.
Common protocols are as follows:
0800 IP
0806 ARP
8137 Novell IPX
809b Apple Talk
If the value of the protocol type field is DC (0-1500 in decimal format), this frame is not of the Ethernet V2 (ARPA) type, but one of the three 802.3 frame types mentioned below;
Ethernet supports TCP/IP, Novell IPX, SPX, and Apple Talk Phase I protocols. RFC 894 defines the Encapsulation Format of IP packets on Ethernet V2;
 
3. Raw 802.3: This is the private Ethernet frame format used by Novell to publish its epoch Netware/86 network suite in 1983,
The format is based on the 802.3 standard that was not officially released at the time;
However, two years later, when the IEEE officially released the 802.3 standard, the IEEE added the 802.3 LLC (Logical Link Control) header to the 802.2 frame header,
This makes the raw 802.3 format of Novell incompatible with the formal IEEE 802.3 standard. We can see that there is no field indicating the protocol type in the raw 802.3 frame structure of Novell,
Only the length field (2 bytes, value: DC, that is, the decimal 0-1500), because raw 802.3 frames only support IPX/SPX protocol;
 
4.802.3/802.2 LLC: the IEEE Standard 802.3, developed by Ethernet V2.
It replaces the protocol type field of the Ethernet V2 frame header with the frame length field (value: DC; decimal 1500 );
Add the 802.2 LLC header to indicate the upper-layer protocol. The LLC header contains DSAP, SSAP, and crontrol fields;
Common sap values:
0 null lsap [IEEE]
4 SNA path control [IEEE]
6 dod ip [79, jbp]
AA snap [IEEE]
Fe global DSAP [IEEE]
The SAP value is used to indicate upper-layer applications, but each sap field is only 8 bits long,
In addition, only 6 bits are reserved for the identification of upper-layer protocols, so the number of protocols that can be identified is limited (up to 32 types );
In addition, IEEE rejects defining sap values for some important protocols, such as ARP (Strangely, they define the sap values of IP addresses at the same time );
Therefore, the use of 802.3/802.2 LLC has great limitations;
 
5.802.3/802.2 snap: This is a standard released by IEEE to ensure that more upper-layer protocols are supported on 802.2 LLC and better support for IP protocols,
Like 802.3/802.2 LLC, 802.3/802.2 snap also has an LLC header, but extends the LLC attribute,
A new 2 bytes protocol type domain is added (set the sap value to AA at the same time ),
So that it can identify more upper-layer protocol types;
In addition, a 3bytes Oui field is added to represent different organizations. RFC 1042 defines the encapsulation method of IP packets in the 802.2 network and the implementation of arp in 802.2 sanp;
 
In today's actual environment, most TCP/IP devices use Ethernet V2 frames.
This is because the first large-scale TCP/IP System (4.2/3 bsd unix) occurs between RFC 894 and RFC 1042,
RFC 894 is used to avoid the risk of interoperability with other hosts;
Because everyone holds this idea, the 802.3 standard has not been popularized as expected;
 
The default Encapsulation Format of the Ethernet interface for Cisco devices is ARPA (Ethernet V2)

Different manufacturers usually have different names for these frame formats, such:
Frame Type novel Cisco
Ethernet version 2 ethernet_ii ARPA
802.3 raw ethernet_802.3 novell_ether
IEEE 802.3/802.2 ethernet_802.2 SAP
IEEE 802.3/802.2 snap ethernet_snap snap

**************************************************************************************************************************************

I. Format Analysis of Ethernet data frames

We all know that most of our current LAN is Ethernet, but Ethernet has many standards and its data frame has multiple formats. I am afraid many people are not very clear about it, the purpose of this article is to distinguish between the frame format and the packet decoding captured by sniffer.

Ethernet generally refers to digital devices
Equipment), Intel, and Xerox jointly announced a standard in 1982 (in fact, it is the second version, the first version as early as 1972
It was generated in Parc at Xerox's Palo Alto Research Center ). It is currently the main LAN technology used by TCP/IP networks. It uses a media access method called CSMA/CD.
It means the carrier sense, multiple access with Collision
Detection ). The speed is 10 Mb/s and the address is 48 bits.

1985, IEEE (Association of electronic and electrical engineers)
The 802 committee published a slightly different standard set, of which 802.3 are for the entire CSMA/CD network, 802.4 are for the Token Bus Network, and 802.5 are for the card ring network. The three
The common feature is defined by the 802.2 standard, that is, the Logical Link Control (LLC) shared by the 802 network ). Unfortunately, 802.2 and 802.3 define a different frame format than Ethernet.
Novell developed private frames for NetWare in 1983, which caused some confusion to Ethernet and brought some impact to us in learning Ethernet.

1. General Basics

The header of the data link layer is the length of the control information of the data link layer.
The formats vary, so you can determine 802.3, 802.3 snap, Ethernet version2, and Netware 802.3.
The main basis for the "Raw" data frames is also the header changes.

We can also see from the sniffer capture data packets that sniffer captures data packets first and foremost.
The Front Guide code is required, and the CRC check is also discarded (note that it only does not show the region in the decode, but does not mean that it does not perform the CRC Check of data packets). This is why many people are confused.
Why is the length of the captured data packet inconsistent with the actual length. So how does sniffer determine these different types of Ethernet formats?

Sniffer can determine different Ethernet formats. Note that sniffer is used for packet decoding.
It has its own format, so offset refers
The value of 15th bits from left to right in the hex decoding window. It doesn't matter if you are a little nervous. After reading the subsequent format analysis, I will analyze the aforementioned content. I believe I can understand it?

The following describes the differences between different Ethernet formats through specific data packets.

2. Ethernet version2

The Ethernet version 2 is earlier than the IEEE standard Ethernet version.

From the data packet, we can see that Ethernet
V2 identifies the receipt processing by using the two-byte type field in the DLC header. The Type field is used to specify the upper-layer protocol (for example, 0800 indicates IP address, 0806 indicates ARP, etc.).
The value must be greater than 05ff. It provides connectionless services and does not control the data length. It requires the network layer to ensure the minimum packet length (46 bytes) of data fields ).

The decoding of the Ethernet V2 frame captured by sniffer can be seen in the DLC layer. The source DLC address is followed by the Ethernet type (etehertype) value 0800, which indicates that the upper layer encapsulates IP packets, 0800 is greater than 05ff, so we can determine that it is an Ethernet V2 frame.

 

3. 802.3

Separates the DLC layer into two obvious sub-layers: the MAC layer and the LLC layer. The MAC layer mainly indicates the hardware Destination Address and source address. The LLC layer is used to provide some services:

-Identify the receiving and sending methods through the sap address

-Compatible with connectionless and connection-oriented services

-Provides the sub-Network Access Protocol (SNAP). The type field is provided by its header.

The MAC layer must ensure that the minimum frame length is not less than 64 bytes. If the data does not meet the 64-byte length, it must be filled.

It is the frame decoding captured by sniffer. It can be seen that the source address of the DLC layer is followed
The length field of 802.3 is 0026, which is smaller than 05ff. It is certain that it is not an Ethernet V2 frame, and the following offset
The value "4242" at 0e (representing DSAP and SSAP) is neither the feature value "FFFF" of Novell 802.3 "raw" nor IEEE 802.3
The feature value of snap is "aaaa", so it must be an IEEE 802.3 frame.

 

4. 802.3 snap

Snap (sub-Network Access
Protocol) subnet access protocol, which is a logical link
Control), which allows the Protocol to implement IEEE-compatible MAC layer functions without using the service access point (SAP). Therefore, its values in the DSAP and SSAP domains are fixed.
(Aaaa ). This is also the source. It requires an additional 5-byte header to specify the receiving method, 3-byte identification vendor code, and 2 bytes identification of the Upper-layer protocol.

The MAC layer ensures that the data frame length is no less than 64 bytes. If the data frame length is insufficient, data needs to be filled.

It is the 802.3 captured by sniffer.
When decoding a snap frame, we can see that the source address of the DLC layer is followed by the length of 802.3 (length) Field 0175, which is smaller than 05ff, and it is certainly not
The frame of Ethernet V2, and the value of the following offset 0e is "aaaa" (representing DSAP and SSAP), which is IEEE 802.3
The feature value of snap is "aaaa", so it can be determined that it is an IEEE 802.3 snap frame.

 

5. Novell Netware 802.3 "raw"

Although it comes before the standard, it has become part of the standard. It only uses the lower half of the DLC layer, rather than the LLC.

802.3 the "Raw" frame marks the length of the data frame by the length field of two bytes in the DLC header, and the length field is followed by the hexadecimal value FFFF of the two bytes, it is used to identify the beginning of the IPX protocol header. To ensure that the minimum data frame length is 64 bytes, the MAC layer fills the data area to ensure the minimum length.

No problem occurs when all workstations use the same data frame type, but if it is in a hybrid Ethernet frame type environment
In, such an Ethernet frame of Novell will have a negative impact: When Novell sends a broadcast frame, its FF field is exactly the Service Access Point (SAP) domain in the frame, and its
The "FF" value represents the broadcast sap, so all workstations (whether Netware or not) will copy, which will cause unnecessary broadcast impact.

Netware 802.3 captured by sniffer
"Raw" frame decoding, you can see that after the source address of the DLC layer is followed by 802.3 length (length) Field 0120, it is smaller than 05ff, you can be sure it is not
Ethernet V2 frame, and the value "ffff" at the next offset 0e (representing the beginning of IPX protocol), which is Netware 802.3
The feature value of "Raw" is "ffff", so it can be determined that it is a Novell 802.3 "Raw" frame.

 

Ii. Comparison between Ethernet V2 frames and IEEE 802.3 Frames

Because these two frames are the most common two frames in the current LAN, we can compare them.

Ethernet V2 can load up to 1500 bytes of data, whereas IEEE
802.3 the maximum data that can be loaded is 1492 bytes (SNAP) or 1497 bytes. Ethernet v2 does not provide the data filling function on the MAC layer, whereas IEEE
802.3 this function is not only provided, but also has service access points (SAP) and snap layers, which can provide more effective data link layer control and better transmission assurance. So we can conclude that
Theory: Ethernet V2 is more suitable for transmitting large amounts of data than 802.3, but Ethernet v2
V2 lacks data link layer control, which is not conducive to the transmission of data that requires strict transmission control. This is also the advantage of 802.3. The more applications that require strict transmission control, the more they need to use
802.3 or snap is encapsulated, but 802.3 also inevitably results in a loss of data loading. Therefore, the encapsulation of this format is often used for a small amount of data but requires strict control.
Transmission Application.

In practical applications, we will find that most applications use Ethernet data packets
V2 frames (such as HTTP, FTP, SMTP, POP3, and other applications), while the BPDU (Bridge Protocol Data Unit) data packets between vswitches are 802.3 frames, VLAN
The trunk protocol, such as 802.1Q and Cisco CDP (Cisco Discovery Protocol), uses the 802.3 protocol.
Snap frame. If you are interested, you can use protocol analysis tools such as sniffer to capture data packets, and then decode and check whether this is the case.