Lesson 3 - Token Ring and SNAP
Token Ring Frame Format
The Token Ring Frame Format Diagram shows the fields that make up a Token Ring frame. It also illustrates the format of a token. Token Ring networks are found primarily in IBM environments, and a special (reserved) indicator bit in the source address comes into play when the stations are operating in a source route bridged (SRB) environment. In order for a frame to reach its proper destination in an SRB network, there is "routing" information present in the frame to indicate the path it must take. The high order bit of the high order byte of the source address is set to indicate that routing information (the RI field) follows the source address. For example, if the source station NIC address was 10 00 5A 01 D6 48 (hex), the address would be changed to 90 00 5A 01 D6 48 to indicate that routing information was included. That is, the "90" represents the fact that the high order bit was turned on in this byte. The bridge software then examines the Routing Information field to determine how the frame is to be forwarded to its destination.
Token Ring Frame Format
The fields that comprise a Token Ring frame are:
Unlike 802.3 Ethernet, an 802.5 Token Ring frame does not have a Length field. Remember, the Length field was added to distinguish 802.3 Ethernet from Version 2 Ethernet. An RI field, if present, follows immediately after the source address, in the case where SRB is being utilized. The RI field contains pairs of hex numbers, which indicate ring and bridge number--the path the frame should take across the rings and bridges that make up the bridged network. The bolded area shows the 802.5 Token Ring header.
DLC: ----- DLC Header ----- DLC: DLC: Frame 2 arrived at 15:57:04.871; frame size is 67 (0043 hex) bytes. DLC: AC: Frame priority 0, Reservation priority 0, Monitor count 1 DLC: FC: LLC frame, PCF attention code: None DLC: FS: Addr recognized indicators: 00, Frame copied indicators: 00 DLC: Destination = Station IBM 0033BF DLC: Source = Station IBM 002FEB DLC: LLC: ----- LLC Header ----- LLC: LLC: DSAP = E0, SSAP = E0, Command, Unnumbered frame: UI LLC: IPX: ----- IPX Header ----- IPX: ADDR Hex ASCII 0000 18 40 10 00 5A 00 33 BF 10 00 5A 00 2F EB E0 E0 .@..Z.3...Z./... 0010 03 FF FF 00 32 00 11 00 00 11 11 10 00 5A 00 33 ....2........Z.3
Note the AC field (0x18) and the FC field (0x40) in the data link control portion of the trace. This indicates a Token Ring frame; an Ethernet frame does not include these fields. The AC field contains bits that indicate whether it is a Token or a data frame. If a Token, then a 3-byte entity, is circulating that consists of an SD, AC, and ED fields. The protocol analyzer shows the FS field directly after the FC field, even though the FS occurs at the end of the frame. An analyzer does not normally display SD, ED, and FCS fields. Tokens are also not displayed by protocol analyzers.
The Monitor count bit is set in the AC field, indicating this frame has been by the ring's Active Monitor Station once. If it comes by again, the Active Monitor will strip it off the ring because it should never go by twice. In Token Rings, the originating node strips the frame off the ring when it comes back around. A frame going around twice means there is something wrong with the station that originated the frame (it could conceivably have been powered down during the process, or the NIC itself had some problem).
SNAP exists for the purpose of encapsulating the older Version 2 Type field value into standard IEEE 802-type frames. SNAP frames have a DSAP and SSAP field contents of AAh. The SNAP Frame Format Diagram shows the 802.2 header and the SNAP header contents:
SNAP Frame Format
The 802.2 header and SNAP header contents include:
The following frame fragment was captured with a Network Associates Sniffer. The AAh following the 76h on line 1 (the one starting with 0000h) is the LLC SNAP DSAP. The OUI field contains all zeros, and the Type field indicates IP (0800). The IP portion of the frame (the IP header) starts with the 45h, which immediately follows the Type field. The frame shown below is a Token Ring frame with the 5-byte SNAP header shown in bold. Here is an instance of including an Ethertype field in a Token Ring frame using SNAP.
DLC: ----- DLC Header ----- DLC: DLC: Frame 3 arrived at 11:21:20.036; frame size is 68 (0044 hex) bytes. DLC: AC: Frame priority 0, Reservation priority 0, Monitor count 0 DLC: FC: LLC frame, PCF attention code: None DLC: FS: Addr recognized indicators: 00, Frame copied indicators: 00 DLC: Destination = Station 3Com 063841 DLC: Source = Station 3Com 115176 DLC: LLC: ----- LLC Header ----- LLC: LLC: DSAP = AA, SSAP = AA, Command, Unnumbered frame: UI LLC: SNAP: ----- SNAP Header ----- SNAP: SNAP: Type = 0800 (IP) SNAP: IP: ----- IP Header ----- IP: IP: Version = 4, header length = 20 bytes ADDR HEX ASCII 0000 10 40 02 60 8C 06 38 41 02 60 8C 11 51 76 AA AA .@.`..8A.`..Qv.. 0010 03 00 00 00 08 00 45 00 00 29 03 19 00 00 FF 06 ......E..)......
Once the proper destination is determined by looking either at the Type or the DSAP fields (or both if SNAP), the frame is then forwarded to the proper Network Layer service for further processing.
What is the reason for using the Subnet Access Protocol, or SNAP?