Learning by Doing: CISCO Certified Network ... - SCN Research

Ethernet Packet Structures
Objective:
To learn about the structure of Ethernet packets.
Background:
So far we have been talking about networking and packets passing over the network. In
this lab we will look at the precise structure of packets. Later when we use protocol
inspectors you will be able to understand the information better.
Ethernet
Ethernet generally refers to a standard developed by a consortium of the Digital
Equipment Corporation (DEC), Intel, and Xerox. It is one of the most widely used
encapsulation standards in use for networking today. There have been many versions and
revisions to it over the past twenty years. So trying to “nail-down” the exact structure of
an Ethernet packet is as easy as nailing jello to the wall. Simply put, you need to be more
specific about which Ethernet packet structure you want to examine. There have many
different types of Ethernet, or “flavors” if you will, and we will look at the two most
common ones: the “generic Ethernet” and “Ethernet SNAP.” Basically our two Ethernet
packet structures are the same except the SNAP packet uses part of the data field for LLC
sub-layer and SNAP information. In either case the minimum/maximum size of our
Ethernet packet is 64-1518 bytes. If the information in the data field will be smaller than
the minimum size allowed then it will be “padded” with contiguous zeros to fill the data
field up to the minimum size.
802.2/802.3 Ethernet (RFC 894)
Preamble SOF DA SA Type Data FCS
Figure 1—Generic Ethernet packet structure.
This “Standard for the Transmission of IP Datagrams Over Ethernet Networks” was
written by Charles Hornig in 1984 (ftp://ftp.isi.edu/in-notes/rfc894.txt ).
Stripped by the NIC:
The preamble can vary in length. The preamble basically is used to help set up the
transmission and reception of the information through synchronization. The actual
amounts of bits have varied over the years but the principle is still the same: a series of
alternating zeroes and ones encompass the preamble. Some of these can be lost during
transmission but that is ok. The incoming stream of bits “establishes” that the reception
of a packet has started. Most agree on 62 bits. (In hex: 1555555555555 In binary:
010101010101010101010101010101010101010101010101010101010101010101010101
0101010101). You will not see this with a protocol sniffer because it is stripped and
dumped.
75