Ethernet Networking
35
Figure 1.13 shows how the LLC header information is added to the data
portion of the frame. Now, let's take a look at an 802.2 frame and SNAP
captured from our analyzer.
802.2 Frame
The following is an 802.2 frame captured with a protocol analyzer. You can
see that the first frame has a Length field, so it's probably an 802.3, right?
Maybe. Look again... it also has a DSAP and an SSAP, so it's not an 802.3.
It has to be an 802.2 frame. (Remember--an 802.2 frame is an 802.3 frame
with the LLC information in the data field of the header so we know what
the upper-layer protocol is.)
Flags: 0x80 802.3
Status: 0x02 Truncated
Packet Length:64
Slice Length: 51
Timestamp: 12:42:00.592000 03/26/1998
Destination: ff:ff:ff:ff:ff:ff Ethernet Broadcast
Source: 00:80:c7:a8:f0:3d
LLC Length: 37
Dest. SAP: 0xe0 NetWare
Source SAP: 0xe0 NetWare Individual LLC
SublayerManagement Function
Command: 0x03 Unnumbered Information
SNAP Frame
The SNAP frame has its own protocol field to identify the upper-layer pro-
tocol. This is really a way to allow an Ethernet_II Ether-Type field to be used
in an 802.3 frame. Even though the following network trace shows a proto-
col field, it is really an Ethernet_II type (Ether-Type) field.
Flags: 0x80 802.3
Status: 0x00
Packet Length:78
Timestamp: 09:32:48.264000 01/04/2000
802.3 Header
Destination: 09:00:07:FF:FF:FF AT Ph 2 Broadcast
Source: 00:00:86:10:C1:6F
LLC Length: 60
Copyright ©2002 SYBEX, Inc., Alameda, CA
www.sybex.com