Page 79

Ethernet Networking

Hex is short for hexadecimal, which is a numbering system that uses the first

six letters of the alphabet (A through F) to extend beyond the available 10 digits

in the decimal system. Hexadecimal has a total of 16 digits.

Source Address (SA) The SA is a 48-bit MAC address used to identify
the transmitting device, and it uses the LSB first. Broadcast and multicast
address formats are illegal within the SA field.

Length or Type field 802.3 uses a Length field, but the Ethernet frame
uses a Type field to identify the Network layer protocol. 802.3 cannot
identify the upper-layer protocol and must be used with a proprietary
LAN--IPX, for example.

Data This is a packet sent down to the Data Link layer from the Net-
work layer. The size can vary from 46 to 1500 bytes.

Frame Check Sequence (FCS) FCS is a field at the end of the frame
that's used to store the cyclic redundancy check (CRC).

Let's pause here for a minute and take a look at some frames caught on

our trusty Etherpeek network analyzer. You can see that the frame below has
only three fields: a Destination, Source, and Type field. This is an Ethernet_II
frame. Notice the type field is IP, or 08-00 in hexadecimal.

Destination: 00:60:f5:00:1f:27

Source: 00:60:f5:00:1f:2c

Protocol Type: 08-00 IP

The next frame has the same fields, so it must be an Ethernet_II frame too.

I included this one so you could see that the frame can carry more than just
IP--it can also carry IPX, or 81-37h. Did you notice that this frame was a
broadcast? You can tell because the destination hardware address is all 1s in
binary, or all Fs in hexadecimal.

Destination: ff:ff:ff:ff:ff:ff Ethernet Broadcast

Source: 02:07:01:22:de:a4

Protocol Type: 81-37 NetWare

Now, pay special attention to the length field in the next frame. This must

be an 802.3 frame. The problem with this frame is this: How do you know
which protocol this packet is going to be handed to at the Network layer? It

www.sybex.com