Ethernet Frame Formats

For mostly historical reasons, Ethernet frames come in various shapes and forms, but they all convey the same information: where the frame originated, where it is destined to, what payload it carries, and a checksum to verify data integrity. Today, essentially two slightly different frame formats exist: EthernetV2 and IEEE 802.3.

It is difficult to authoritatively assess the proportion of EthernetV2 versus 802.3 in today's network—a rough estimate would probably call for 80 percent EthernetV2 for 20 percent of 802.3. However, it is not necessary to worry about the exact repartition because all LAN switches support both formats, and exploits are comfortable with both frame formats. Figure 2-1 shows these frame formats.

Figure 2-1 Ethernet Frame Formats

Ethernetv2 Value

>=0x0600

Figure 2-1 Ethernet Frame Formats

Ethernetv2 Value

>=0x0600

Preamble

Destination MAC

Source MAC

Ethertype

Data

CRC

8 Bytes 6 6 2 46-1500 4

8 Bytes 6 6 2 46-1500 4

IEEE 802.3 Value

<0x0600

IEEE 802.3 Value

<0x0600

Preamble	Destination	Source	Length	Data	CRC
	MAC	MAC

8 Bytes 6 6 2 46-1500 4

8 Bytes 6 6 2 46-1500 4

As you look at Figure 2-1, keep these things in mind:

• 802.3 actually comprises two more subformats: 802.2 (802.3 with an 802.2 header) and Subnetwork Access Protocol (SNAP) encapsulation (802.3 with 802.2 and a SNAP header). (They are not shown in Figure 2-1 because they are irrelevant to this discussion, and they are beyond the scope of this book.) Indeed, LAN switches build their bridging tables by simply learning source MAC addresses, and source MAC addresses always appear at the same offset regardless of the encapsulation being used. It's a good idea to know what 802.2 refers to in case you ever come across the term.

• Ethernet frames are always prefixed by a 64-bit preamble. Put simply, its purpose is to allow time for the receiver to get ready to collect data bits for the MAC layer to process.

The only item that differentiates EthernetV2 from 802.3 is the interpretation of the third field. In EthernetV2, it is called an Ethertype, while in 802.3 it is called the length field and indicates how many bytes of data follow. Because the maximum payload length on Ethernet (jumbo frames excluded) is 1500 (0x5DC), Ethertypes are never assigned values lower than 0x5DC. As a matter of fact, to avoid any ambiguity, Ethertypes start at 0x600. Ethertypes indicate what upper-layer protocol is carried by the frame. IP uses 0x0800, for example, while IEEE 802.1Q tags use 0x8100. The Internet Assigned Numbers Authority (IANA) assigns Ethertypes.

Continue reading here: Forcing an Excessive Flooding Condition

Was this article helpful?

0 0