ARP and SNAP encapsulation

[hostettle]

Hi,

It's again a generic question.

Have you ever seen ARP directly encapsulated in MAC, without the LLC/SNAP format?

That is:

DA / SA / Ethertype 0x0806 / ARP PDU

Instead of:

DA / SA / 0xAAAA03 000000 0806 / ARP PDU

Thanks for your words,

best regards,

Michel

[Peter Paluch · Accepted solution]

Hi Michel,

Are you sure about your question? I would say that the opposite is true: the ARP are always encapsulated in plain Ethernet_II frames. I have never seen an ARP encapsulated inside SNAP Ethernet frame.

I am attaching a simple PCAP file - open it using Wireshark. There you can see a couple of ARP messages being encapsulated in the plain Ethernet_II (or the DIX) format.

Best regards,

Peter

[hostettle]

Hi Peter,

Glurps! sorry for the mistake. I had 2 old versions of slides for ARP, and I took the wrong one for a description in Ethernet.

I keep your PCAP file, I need to download Wireshark on my little PC.

Thanks very much,

best regards,

Michel

[Peter Paluch]

Hello Michel,

You are heartily welcome.

You may be interested to know that while it is possible to encapsulate the ARP both into Ethernet_II and SNAP frames, it is not possible to encapsulate the ARP into 802.2 LLC frames using the DSAP/SSAP/Control bytes because the ARP was not officially assigned any SAP (DSAP/SSAP) value. The funny thing is that the IP does have the SAP value 0x06 - but you cannot use IP on Ethernet without using ARP (well, of course, you could use static ARPs but it would drive you crazy very soon ), so the 802.2 LLC frame format on Ethernet was never used to carry IP traffic.

The list of officially assigned SAP codes can be found here:

http://standards.ieee.org/develop/regauth/llc/public.html

Best regards,

Peter

[hostettle]

Hi Peter,

(1) Thanks for your remark

> The funny thing is that the IP does have the SAP value 0x06 - but you cannot use IP on Ethernet without using

> ARP (well, of course, you could use static ARPs but it would drive you crazy very soon )...

In the link you give, I see the reference to RFC 791. This RFC is dated from september 1981. Probably, at that time there was not yet the ARP mechanism (I didn't see the date) - and perhaps an Arpanet method was implied.

(2) I don't know how I did, but it works! I displayed your traces.

Now, I'm surprised to see "ARP request" without a broadcast DA, see the frames 9 and 11. Have you an explanation?

Best regards,

Michel