Protocol Analysis - Unit 2 Sec 3a

Unit 2

Lesson 3 - Token Ring and SNAP

Token Ring Frame Format

The Token Ring Frame Format Diagram shows the fields that make up a Token Ring frame. It also illustrates the format of a token. Token Ring networks are found primarily in IBM environments, and a special (reserved) indicator bit in the source address comes into play when the stations are operating in a source route bridged (SRB) environment. In order for a frame to reach its proper destination in an SRB network, there is "routing" information present in the frame to indicate the path it must take. The high order bit of the high order byte of the source address is set to indicate that routing information (the RI field) follows the source address. For example, if the source station NIC address was 10 00 5A 01 D6 48 (hex), the address would be changed to 90 00 5A 01 D6 48 to indicate that routing information was included. That is, the "90" represents the fact that the high order bit was turned on in this byte. The bridge software then examines the Routing Information field to determine how the frame is to be forwarded to its destination.

Token Ring Frame Format

The fields that comprise a Token Ring frame are:

	SD (Start Delimiter, 1 byte)--Used to synchronize the hardware clock and alert each station of a frame.
	AC (Access Control, 1 byte)--Contains the Frame Priority field (3 bits), the Reservation field (3 bits), as well as a bit used to differentiate between a token and an information frame. The eighth bit is used by the Active Monitor station.
	FC (Frame Control, 1 byte)--Indicates whether the frame contains data destined for LLC, and subsequently the upper layers, or if the frame is for low-level ring management. The Physical Control field (PCF) manages the Physical Layer. Things like ring recovery due to a lost token are handled here.
	DA/SA (Destination and Source Addresses, 12 bytes)--Two 6-byte Address fields identifying the destination and source stations. Like Ethernet, the first 3 bytes of each NIC address is the manufacturer's code.
	RI (Routing Information, 0 - 18 bytes)--An optional field that is present when SRB is being used.
	Information (variable)--Token Ring frames can theoretically be over 17,000 bytes long. However, frames exceeding about 4,000 bytes are not seen in many Token Ring networks. Also, if a Token Ring network is connected to an Ethernet network by a translational bridge, the frame size on the Token Ring network must be limited to less than 1,500 bytes, because unlike IP packets, there is no protocol in bridges for fragmenting and reassembling frames.
	FCS (Frame-Check Sequence, 4 bytes)--Used to provide error checking. If the frame is bad, it is discarded.
	ED (End Delimiter, 1 byte)--Signals the end of a token or an information frame.
	FS (Frame Status, 1 byte)--The FS field includes two address-recognized indicator bits and two frame-copied indicator bits. The bits are duplicated because the FS is not included in the FCS, and it comes after it. Therefore, in order to provide some type of an error check, the bits are duplicated. If they are not identical, there is an error.

Unlike 802.3 Ethernet, an 802.5 Token Ring frame does not have a Length field. Remember, the Length field was added to distinguish 802.3 Ethernet from Version 2 Ethernet. An RI field, if present, follows immediately after the source address, in the case where SRB is being utilized. The RI field contains pairs of hex numbers, which indicate ring and bridge number--the path the frame should take across the rings and bridges that make up the bridged network. The bolded area shows the 802.5 Token Ring header.

DLC:  ----- DLC Header -----
DLC:
DLC:  Frame 2 arrived at  15:57:04.871; frame size is 67 (0043 hex) bytes.
DLC:  AC: Frame priority 0,  Reservation priority 0,  Monitor count 1
DLC:  FC: LLC frame,  PCF attention code: None
DLC:  FS: Addr recognized indicators: 00, Frame copied indicators: 00
DLC:  Destination = Station IBM   0033BF
DLC:  Source      = Station IBM   002FEB
DLC:
LLC:  ----- LLC Header -----
LLC:
LLC:  DSAP = E0, SSAP = E0, Command, Unnumbered frame: UI
LLC:
IPX:  ----- IPX Header -----
IPX:

ADDR  Hex                                               ASCII
0000  18 40 10 00 5A 00 33 BF  10 00 5A 00 2F EB E0 E0  .@..Z.3...Z./...
0010  03 FF FF 00 32 00 11 00  00 11 11 10 00 5A 00 33  ....2........Z.3

Note the AC field (0x18) and the FC field (0x40) in the data link control portion of the trace. This indicates a Token Ring frame; an Ethernet frame does not include these fields. The AC field contains bits that indicate whether it is a Token or a data frame. If a Token, then a 3-byte entity, is circulating that consists of an SD, AC, and ED fields. The protocol analyzer shows the FS field directly after the FC field, even though the FS occurs at the end of the frame. An analyzer does not normally display SD, ED, and FCS fields. Tokens are also not displayed by protocol analyzers.

The Monitor count bit is set in the AC field, indicating this frame has been by the ring's Active Monitor Station once. If it comes by again, the Active Monitor will strip it off the ring because it should never go by twice. In Token Rings, the originating node strips the frame off the ring when it comes back around. A frame going around twice means there is something wrong with the station that originated the frame (it could conceivably have been powered down during the process, or the NIC itself had some problem).

SNAP

SNAP exists for the purpose of encapsulating the older Version 2 Type field value into standard IEEE 802-type frames. SNAP frames have a DSAP and SSAP field contents of AAh. The SNAP Frame Format Diagram shows the 802.2 header and the SNAP header contents:

SNAP Frame Format

The 802.2 header and SNAP header contents include:

	DSAP field--AAh
	SSAP field--AAh
	Control field 03h
	Org. Code or OUI (Organizationally Unique Identifier) a 3-byte field containing a manufacturer's code. Often has the contents of 00 00 00h. This field may contain a value when LLC encapsulation is used on certain ATM links.
	Type field--2 bytes containing the Type field
	Some common Ethernet protocol types (Ethertypes) are: - 0800h--IP - 0806h--ARP - 6010-6014h--3Com - 809Bh--AppleTalk over Ethernet - 8100h--802.1Q VLAN - 8138h--Novell - 86DDh--IP version 6

The following frame fragment was captured with a Network Associates Sniffer. The AAh following the 76h on line 1 (the one starting with 0000h) is the LLC SNAP DSAP. The OUI field contains all zeros, and the Type field indicates IP (0800). The IP portion of the frame (the IP header) starts with the 45h, which immediately follows the Type field. The frame shown below is a Token Ring frame with the 5-byte SNAP header shown in bold. Here is an instance of including an Ethertype field in a Token Ring frame using SNAP.

DLC:  ----- DLC Header -----
DLC:
DLC:  Frame 3 arrived at 11:21:20.036; frame size is 68 (0044 hex) bytes.
DLC:  AC: Frame priority 0, Reservation priority 0,  Monitor count 0
DLC:  FC: LLC frame, PCF attention code: None
DLC:  FS: Addr recognized indicators: 00, Frame copied indicators: 00
DLC:  Destination = Station 3Com 063841
DLC:  Source      = Station 3Com 115176
DLC:
LLC:  ----- LLC Header -----
LLC:
LLC:  DSAP = AA, SSAP = AA, Command, Unnumbered frame: UI
LLC:
SNAP: ----- SNAP Header -----
SNAP:
SNAP: Type = 0800 (IP)
SNAP:
IP:   ----- IP Header -----
IP:
IP:   Version = 4, header length = 20 bytes

ADDR  HEX                                               ASCII
0000  10 40 02 60 8C 06 38 41  02 60 8C 11 51 76 AA AA  .@.`..8A.`..Qv..
0010  03 00 00 00 08 00 45 00  00 29 03 19 00 00 FF 06  ......E..)......

Once the proper destination is determined by looking either at the Type or the DSAP fields (or both if SNAP), the frame is then forwarded to the proper Network Layer service for further processing.

What is the reason for using the Subnet Access Protocol, or SNAP?

[ Previous Section ] [ Unit Contents ] [ Next Lesson ]