- check out the stylin' NEW Collusion haxor gear at Jinx Hackwear!!! -
- sign up on the Collusion Syndicate's infotainment discussion lists!!! -

Volume 13
Jul 2000


 HOME

 TechKnow
 Media Hack
 Parallax
 Reviews
 Fiction
 Humor
 Events
 Offsite

 Mission
 Responses
 Discussion
 #Collusion
 NEW!

 Submit a Story
 Collusioneers
 © & TM Info
 Contact Us


SETI@Home

Join the
Collusion
SETI Team!




Introduction to Ethernet Frame Types
 by TexorcisT

This is a general overview to familiarize people interested in learning some of the lower level architecture of internetworking. To keep from covering any information that could be considered insipid, I am keeping it narrowly scoped. Any additional questions should be addressed to the response section and will be answered in discussion.

There are a couple of different types of common Ethernet frame configurations used today. They are the Ethernet_II (the 'blue book') frame, developed by Xerox, the IEEE LAN standard 802.2 and 802.3 Carrier Sense Multiple Access/Collision Detection (CSMA/CD) frame, developed by the Institute of Electrical and Electronic Engineers and Ethernet SNAP. Ethernet_II is the Internet standard. 802.2 and 802.3 are used by Novell. 802.2 is default for NetWare 3.12 and above while 802.3 is used in previous versions. Ethernet SNAP is used when AppleTalk is involved.

The Ethernet_II frame's makeup is as follows:

Bytes     Element
  8     Preamble
  6     Destination Address (DA)
  6     Source Address (SA)
  2     Protocol Type
46-1500 Service Data Unit (SDU)
  4     Frame Check Sequence (FCS)
  5 

The 802.2 (802.3 with LLC) frame's makeup is as follows:

Bytes     Element
  8     Preamble
  6     Destination Address (DA)
  6     Source Address (SA)
  2     Length
  1     Destination Service Access Point (DSAP)
  1     Source Service Access Point (SSAP) and High Level 
  1     Data Link Control (HDLC)
43-1497 Service Data Unit (SDU)
  4     Frame Check Sequence (FCS)

The 802.3 frame's makeup is as follows:

Bytes     Element
  8     Preamble
  6     Destination Address (DA)
  6     Source Address (SA)
  2     Length
46-1500 Service Data Unit (SDU)
  4     Frame Check Sequence (FCS)

The Ethernet SNAP frame's makeup is as follows:

Bytes     Element
  8     Preamble
  6     Destination Address (DA)
  6     Source Address (SA)
  2     Length
  1     Destination Service Access Point (DSAP)
  1     Source Service Access Point (SSAP) and High Level 
  1     Data Link Control (HDLC)
  3     Oganiztion Code
  2     Ethernet Type
38-1492 Service Data Unit (SDU)

All frames start with an eight bit Preamble. After which is the Media Access Control (MAC) protocol encapsulation header consisting of the Destination Address (DA), Source Address (SA), and followed by the Type element in Ethernet_II or the Length element in 802.2, 802.3 and SNAP. The "Ethernet Type" values are managed by Xerox. Some assignments are public, others private. (chart below)

After the Length element, the 802.3 frame type can vary depending on if the incorporation of the IEEE 802.2 Logical Link Control (LLC) is being used. If used, the LLC is designed to bridge the gap in the Data Link Layer of the OSI model between the Media Access Control (MAC) sublayer and the Network Layer. When the LLC protocol is used, the MAC layer PDU (the payload data) is further encapsulated, adding two additional header fields called Service Access Points (SAPs) that identify the applications/users involved. Unlike the Destination SAP (DSAP), the Source SAP (SSAP) icludes an additional byte to define High Level Data Link Control (HDLC) mode which provides reliable data transfer using numbered control frames. If using SNAP there are 3bytes for organization code and 2 more for Ethernet Type.

At this point, the data to be transfered is pasted in. It is also important to note that if we are dealing with an 802.2 and SNAP frame, the SDU size limitations change from 46-1500 byte to 43-1497 and 38-1492 bytes (perspectivly) to accomidate for the extra encapsulation. This is to assure the packet stays below the 1518 byte 'Giant Frame' maximum and above the 64 byte 'Runt Frame' minimum. Otherwise these frame will be considered malformed and discarded.

Ethernet_II, 802.2 and 802.3 frames end by converting the Packet Data Unit (PDU) in to the Service Data Unit (SDU) element, and then creating a CRC that is stored in the Frame Check Sequence (FCS) for use in performing a quick check on data integrity at the final destination (and sometimes in route by some bridges/switches and routers).


Ethernet_II Type Element Codes:

Note   Hex       Definition
@    0000-05DC IEEE802.3 Length Field (0.:1500.)
+    0101-01FF Experimental
     0200 Xerox PUP (conflicts with 802.3 Length Field
          range) (see 0A00)
     0201 Xerox PUP Address Translation (conflicts ...)
          (see 0A01)
     0400 Nixdorf (conflicts with 802.3 Length Field)
+*   0600 Xerox NS IDP
     0601 XNS Address Translation (3Mb only)
+*   0800 DOD Internet Protocol (IP)
+    0801 X.75 Internet
+    0802 NBS Internet
+    0803 ECMA Internet
+    0804 CHAOSnet
+    0805 X.25 Level 3
+*   0806 Address Resolution Protocol (ARP) (for IP and for
          CHAOS)
     0807 XNS Compatibility
     081C Symbolics Private
+    0888-088A Xyplex
     0900 Ungermann-Bass network debugger
     0A00 Xerox IEEE802.3 PUP
     0A01 Xerox IEEE802.3 PUP Address Translation
     0BAD Banyan Systems
     0BAF Banyon VINES Echo
     1000 Berkeley Trailer negotiation
     1001-100F Berkeley Trailer encapsulation for IP
     1234 DCA - Multicast
*    1600 VALID system protocol
     1989 Artificial Horizons ("Aviator" dogfight simulator 
          [on Sun])
     1995 Datapoint Corporation (RCL lan protocol)
     3C00 3Com NBP virtual circuit datagram (like XNS SPP) 
     not registered
     3C01 3Com NBP System control datagram not registered
     3C02 3Com NBP Connect request (virtual cct) not 
          registered
     3C03 3Com NBP Connect repsonse not registered
     3C04 3Com NBP Connect complete not registered
     3C05 3Com NBP Close request (virtual cct) not 
          registered
     3C06 3Com NBP Close response not registered
     3C07 3Com NBP Datagram (like XNS IDP) not registered
     3C08 3Com NBP Datagram broadcast not registered
     3C09 3Com NBP Claim NetBIOS name not registered
     3C0A 3Com NBP Delete Netbios name not registered
     3C0B 3Com NBP Remote adaptor status request not 
          registered
     3C0C 3Com NBP Remote adaptor response not registered
     3C0D 3Com NBP Reset not registered
     4242 PCS Basic Block Protocol
     424C       Information Modes Little Big LAN diagnostic
     4321 THD - Diddle
     4C42       Information Modes Little Big LAN
%    5208 BBN Simnet Private
     6000 DEC unassigned, experimental
     6001 DEC Maintenance Operation Protocol (MOP) 
          Dump/Load Assistance
     6002 DEC Maintenance Operation Protocol (MOP) Remote 
          Console
     6003 DECNET Phase IV, DNA Routing
     6004 DEC Local Area Transport (LAT)
     6005 DEC diagnostic protocol (at interface 
          initialization?)
     6006 DEC customer protocol
     6007 DEC Local Area VAX Cluster (LAVC), System 
          Communication Architecture (SCA)
     6008 DEC AMBER
     6009 DEC MUMPS
+    6010-6014 3Com Corporation
     7000 Ungermann-Bass download
     7001 Ungermann-Bass NIUs
     7002 Ungermann-Bass diagnostic/loopback
     7003 Ungermann-Bass ??? (NMC to/from UB Bridge)
     7005 Ungermann-Bass Bridge Spanning Tree
     7007 OS/9 Microware
     7009 OS/9 Net?
+    7020-7029 LRT (England) (now Sintrom)
     7030 Racal-Interlan
     7031 Prime NTS (Network Terminal Service)
     7034 Cabletron
     8003 Cronus VLN
     8004 Cronus Direct
     8005 HP Probe protocol
+    8006 Nestar
+    8008 AT&T/Stanford Univ. Local use
     8010 Excelan
+    8013 Silicon Graphics diagnostic
+    8014 Silicon Graphics network games
+    8015 Silicon Graphics reserved
+    8016 Silicon Graphics XNS NameServer, bounce server
+    8019 Apollo DOMAIN
+    802E Tymshare
+    802F Tigan, Inc.
+    8035 Reverse Address Resolution Protocol (RARP)
+    8036 Aeonic Systems
     8037 IPX (Novell Netware?)
     8038 DEC LanBridge Management
     8039 DEC DSM/DDP
     803A DEC Argonaut Console
     803B DEC VAXELN
     803C DEC DNS Naming Service
     803D DEC Ethernet CSMA/CD Encryption Protocol
     803E DEC Distributed Time Service
     803F DEC LAN Traffic Monitor Protocol
     8040 DEC PATHWORKS DECnet NETBIOS Emulation
     8041 DEC Local Area System Transport
     8042 DEC unassigned
+    8044 Planning Research Corp.
+    8046 AT&T
+    8047 AT&T
     8048 DEC Availability Manager for Distributed Systems 
          DECamds (but someone at DEC says not)
+    8049 ExperData
+    805B VMTP (Versatile Message Transaction Protocol, RFC-
          1045) (Stanford) [experimental]
+    805C Stanford V Kernel, version 6.0
+    805D Evans & Sutherland
+    8060 Little Machines
+    8062 Counterpoint Computers
+    8065 University of Mass. at Amherst
+    8066 University of Mass. at Amherst
+    8067 Veeco Integrated Automation
+    8068 General Dynamics
+    8069 AT&T
+    806A Autophon
+    806C ComDesign
+    806D Compugraphic Corporation
+    806E-8077 Landmark Graphics Corporation
+    807A Matra
+    807B Dansk Data Elektronik
+    807C Merit Internodal (or Univ of Michigan?)
+    807D-807F Vitalink Communications
+    8080 Vitalink TransLAN III Management
+    8081-8083 Counterpoint Computers
     8088-808A Xyplex
+    809B EtherTalk (AppleTalk over Ethernet)
+    809C-809E Datability
+    809F Spider Systems Ltd.
+    80A3 Nixdorf Computers
+    80A4-80B3 Siemens Gammasonics Inc.
+    80C0-80C3 DCA (Digital Comm. Assoc.) Data Exchange 
               Cluster
+    80C6 Pacer Software
+    80C7 Applitek Corporation
+    80C8-80CC Intergraph Corporation
+    80CD-80CE Harris Corporation
+    80CF-80D2 Taylor Instrument
+    80D3-80D4 Rosemount Corporation
     80D5 IBM SNA Services over Ethernet
+    80DD Varian Associates
+    80DE-80DF TRFS (Integrated Solutions Transparent 
               Remote File System)
+    80E0-80E3 Allen-Bradley
+    80E4-80F0 Datability
+    80F2 Retix
+    80F3 AppleTalk Address Resolution Protocol (AARP)
+    80F4-80F5 Kinetics
+    80F7 Apollo Computer
+    80FF-8101 Wellfleet Communications
+    8102 Wellfleet; BOFL (Breath OF Life) pkts [every 5-10 
          secs.]
+    8103 Wellfleet Communications
     8107-8109 Symbolics Private
     812B Talaris
+    8130 Waterloo Microsystems Inc.
+    8131 VG Laboratory Systems
+    8137 Novell (old) NetWare IPX (ECONFIG E option)
+    8138 Novell, Inc.
+    8139-813D KTI
     813F M/MUMPS data sharing
     8145 Vrije Universiteit (NL)  Amoeba 4 RPC (obsolete)
     8146 Vrije Universiteit (NL)  FLIP (Fast Local 
          Internet Protocol)
     8147 Vrije Universiteit (NL)  [reserved]
     814C SNMP over Ethernet (see RFC1089)
     814F Technically Elite Concepts Network Professor
     8191 PowerLAN   NetBIOS/NetBEUI (PC)
     817D XTP
     81D6 Artisoft Lantastic
     81D7 Artisoft Lantastic
     8203-8205 QNX Software Systems Ltd.
     8390 Accton Technologies (unregistered)
     852B Talaris multicast
     8582 Kalpana
     86DD       IP version 6
     8739 Control Technology Inc.  RDP Without IP
     873A Control Technology Inc.  Mcast Industrial Ctrl 
          Proto.
     873B Control Technology Inc.  Proprietary
     873C Control Technology Inc.  Proprietary
     8820 Hitachi Cable (Optoelectronic Systems Laboratory)
     8856 Axis Communications AB  proprietary 
          bootstrap/config
     8888 HP LanProbe test?
+    9000 Loopback (Configuration Test Protocol)
     9001 3Com (Formerly Bridge Communications), XNS 
          Systems Management
     9002 3Com (Formerly Bridge Communications), TCP/IP 
          Systems Management
     9003 3Com (Formerly Bridge Communications), loopback 
          detection
     AAAA DECNET?  Used by VAX 6220 DEBNI
     FAF5 Sonix Arpeggio
%    FF00 BBN VITAL-LanBridge cache wakeups

Notes:
* These protocols use Ethernet broadcast, where multicast would be preferable.
% Possible Private Protocols, i.e. not registered
+ These are publicly assigned numbers. Only vendors are listed by Xerox, not protocols.
@ Anything less than 600H, the packet is assumed to be an 802.3 packet; if it is greater than 600H, the packet is flagged as an Ethernet packet.