Unit 2

Lesson 2 - Ethernet Version 2, 802.3, and 802.1Q

Ethernet Version 2

The original Ethernet Version 2 frame varies slightly from the 802.3 Ethernet frame format in that a Type field, also referred to as Ethertype, is used in place of the Length field (also 2 bytes), as shown on the Ethernet V2 Frame Format Diagram.


Ethernet V2 Frame Format

Ethernet V2 Frame Format

The Type field is used to "steer" the information up the protocol stack to the next layer, just as the DSAP value did in the 802.2 LLC header. Examples of Ethertype values are 0x0800 for IP and 0x0806 for Address Resolution Protocol (ARP). In order to not confuse the Type field with the Length field, Type values start at 0x0600. This value, when converted to decimal is 1536, which would be an illegal Ethernet frame length, so values above 0x0600 are Version 2 frames. The following trace fragment illustrates an Ethernet Version 2 MAC header in bold. The Type field indicates that ARP is being carried in the frame.

DLC:  ----- DLC Header -----
DLC:
DLC:  Frame 1 arrived at  23:33:39.6638; frame size is 60 (003C hex) bytes.
DLC:  Destination = BROADCAST FFFFFFFFFFFF, Broadcast
DLC:  Source      = Station WstDig488C11
DLC:  Ethertype  = 0806 (ARP)
DLC:
ARP:  ----- ARP/RARP frame -----
ARP:


ADDR  HEX                                               ASCII
0000  FF FF FF FF FF FF 00 00  C0 48 8C 11 08 06 00 01  .........H......
0010  08 00 06 04 00 01 00 00  C0 48 8C 11 80 01 00 02  .........H......
0020  00 00 00 00 00 00 80 01  00 01 00 00 00 00 00 00  ................
Ethernet 802.3

The 802.3 format of an Ethernet frame is shown on the IEEE 802.3 Ethernet Frame Format Diagram. It has a Length field instead of a Type field, and an 802.2 LLC header (not shown) in the Information field. As mentioned in the previous lesson, the LLC header DSAP field indicates the protocol being carried and steers the frame to the appropriate process in the Network Layer. An 802.3 Length field will always have a value of less than 0x0600.


IEEE 802.3 Ethernet Frame Format

IEEE 802.3 Ethernet Frame Format

The following frame fragment was captured with a Network Associates Sniffer. The frame begins with the destination address, and the 802.3 MAC header continues to the end of the Length field. The 802.3 header is shown in bold. The frame size of 143 and the 802.3 length differ by 14 bytes, which is the length of the 802.3 header, not counting the Preamble and Start of Frame Delimiter (SOFD) fields. In other words, the Length field does not take into account the MAC header. Remember, the Preamble and SOFD are for synchronizing the hardware clock for accurate bit timing prior to reading the frame.

DLC:  ----- DLC Header -----
DLC:
DLC:  Frame 1 arrived at 09:18:37.3543; frame size is 143 (008F hex) bytes.
DLC:  Destination = Station 3Com 676974
DLC:  Source      = Station 3Com 741178
DLC:  802.3 length = 129
DLC:
LLC:  ----- LLC Header -----
LLC:
LLC:  DSAP = F0, SSAP = F0, Command, I frame, N(R) = 29, N(S) = 109
LLC:
NETB: ----- NETBIOS Data Only Last -----

ADDR  HEX                                                ASCII
0000  02 60 8C 67 69 74 02 60   8C 74 11 78 00 81 F0 F0  .`.git.`.t.x....
0010  DA 3A 0E 00 FF EF 16 00   00 00 00 00 6B 16 19 01  .:..........k...
0020  FF 53 4D 42 2D 00 00 00   00 08 00 00 00 00 00 00  .SMB-...........
0030  00 00 00 00 00 00 00 00   18 08 05 00 00 00 94 07  ................
0040  0F 2E 00 58 00 01 00 40   00 16 00 20 00 00 00 00  ...X...@... ....
0050  00 01 00 00 00 00 00 FE   FF FF FF 00 00 00 00 17  ................
0060  00 5C 33 43 4F 4D 5C 4D   53 42 45 4E 43 48 5C 53  .\3COM\MSBENCH\S
0070  59 4E 43 2E 43 4D 44 00   0A FF 00 00 00 00 00 00  YNC.CMD.........
0080  00 00 00 00 10 00 00 00   00 00 00 00 00 00 00     ...............
802.1Q VLAN Frames

With the establishment of the 802.1Q VLAN standard, it is now possible to mix vendor switch equipment and have the VLANs interoperate. That is, frames traveling from switch-to-switch between VLANs carry VLAN membership information that all equipment meeting the standard recognize. The 802.1Q tag follows the standard MAC header in Ethernet frames. If the frame is VLAN-tagged, the Type field contains a value of 0x8100. The VLAN-tag format uses the next 2 bytes after the 0x8100 Type field for the VLAN tag. These 16 bits contain the 3-bit frame priority, the canonical format indicator (CFI), and the 12-bit VLAN ID.

Another way of looking at this is that Ethernet frames have either a Length or a Type field. When using LLC, the field is Length-encoded. If not using LLC, the field is Type-encoded. Following the VLAN tag would be the original 802.3 Length field or Version 2 Type value that the frame would have carried had it not been tagged. That is, if this is an 802.1Q-tagged Type-encoded frame carrying IP, the 2 bytes after the VLAN tag will be 0x0800. If the original frame was Length-encoded, the 2 bytes following the VLAN tag would be a Length field, followed by the LLC header as the first part of the Information field.

If Length-encoded:

    8100 0020 01A6--The 8100h and 0020h are the 4 additional VLAN bytes; the 01A6 is an example of a valid 802.3 length; the LLC header would follow in the Information field. This concept is illustrated on the 802.1Q Length-Encoded Frame Format Diagram.

802.1Q Length-Encoded Frame Format

802.1Q Length-Encoded Frame Format

If Type-encoded:

    8100 0020 0800--The 0800h is in the Type field, indicating IP is being carried. This
    concept is illustrated on the 802.1Q Type-Encoded Frame Format Diagram.

802.1Q Type-Encoded Frame Format

802.1Q Type-Encoded Frame Format

In the sample 802.1Q tagged frame that follows:

    Type field (0x8100) indicates a VLAN tag

    Priority (3 bits)--the 802.1p frame priority, 0 to 7, with 7 being the highest

    CFI 1 bit

    VLAN IDentifier (VLID 12 bits = 4,096 possible VLANs)

    Original Type field (0x0800, indicating IP)


Frame 10 (70 on wire, 70 captured)
Ethernet II
    Destination: 00:60:08:9f:b1:f3
    Source: 00:40:05:40:ef:24
    Type: 802.1Q Virtual LAN (0x8100)
802.1Q Virtual LAN
    000. .... .... .... = Priority: 0
    ...0 .... .... .... = CFI: 0
    .... 0000 0010 0000 = ID: 32
    Type: IP (0x0800)
Internet Protocol
    Source: 131.151.32.129
    Destination: 131.151.32.21
Transmission Control Protocol
    Source port: 1162 (1162)
    Destination port: 6000 (6000)
	
ADDR  HEX                                       ASCII
   0  0060 089f b1f3 0040 0540 ef24 8100 0020   .`.....@.@.$...
  10  0800 4500 0034 3b37 4000 4006 b7c8 8397   ..E..4;7@.@.....
  20  2081 8397 2015 048a 1770 4e14 df55 4d3d   ... ....pN..UM=
  30  5c99 8010 6918 3c4c 0000 0101 080a 0004   \...i.<L........
  40  f0c8 0199 a3f3                            ......
  

Note the VLAN ID of 32 in the trace. The ID field is numbered starting from the right with 1, 2, 4, 8, 16, 32, 64, etc. The bit indicating a value of "32" is set at the VLAN ID. The CFI is used for compatibility between Ethernet and Token Ring networks. Because the Priority bits are all zero, this indicates the frame was sent at low priority.

[ Previous Section ] [ Unit Contents ] [ Next Lesson ]