05-07-2010 06:01 PM - edited 03-06-2019 10:59 AM
Hi every body.
I have few questions about Snap header in the 802.3 ethernet.
My book says" another popular option exits for the protocol type field,particularly when sending ip packets. If the 802.3 type/length has a value less than 1536,the type/length field is used as length field for tthat frame,identifying the length of entire frame. In that case another field is needed to identify the type L3pdu inside the frame. " Snap header is inserted the frame to identify the L3pdu.
My question is how common is it to find ethernet with snap header carrying ip packets? Most of the ip packet i captured using wire shark, use the 802.3 ethernet where type field is used to indicate the encapsulated ip packet. Is it common for ip packets to use ethernet framing weith simply" type" field?
thanks and have a nice weekend.
Solved! Go to Solution.
05-08-2010 01:43 AM
Hello Sarah,
we probably had discussed this in some older thread
It is really difficult nowdays to find an IP packet encapsulated in an ethernet frame without using Eth II
The reason is that it is not efficient to use SNAP it adds a bigger overhead (up to 8 bytes overhead 3 bytes LLC 5 bytes SNAP 3 bytes oui + 2 bytes protocol type )
There are however some protocol messages that use this kind of encapsulation or similar
(these use only LLC header to be correct)
ISIS frames
ISO CLNP
STP IEEE standard BPDUs
Also SNA traffic use this kind of encapsulation (LLC encapsulation I mean, again to be correct)
so with some patience connecting to a LAN switch you could capture an STP frame and you could see the DSAP SSAP and other fields
So your book may have reported a sentence from an older book or it is old itself
Edit:
in the following link you can see a list of L2 signalling protocols like CDP, VTP, DTP and they use SNAP
http://www.cisco.com/en/US/products/hw/switches/ps700/products_white_paper09186a00801b49a4.shtml
Have a nice weekend
Hope to help
Giuseppe
05-08-2010 01:43 AM
Hello Sarah,
we probably had discussed this in some older thread
It is really difficult nowdays to find an IP packet encapsulated in an ethernet frame without using Eth II
The reason is that it is not efficient to use SNAP it adds a bigger overhead (up to 8 bytes overhead 3 bytes LLC 5 bytes SNAP 3 bytes oui + 2 bytes protocol type )
There are however some protocol messages that use this kind of encapsulation or similar
(these use only LLC header to be correct)
ISIS frames
ISO CLNP
STP IEEE standard BPDUs
Also SNA traffic use this kind of encapsulation (LLC encapsulation I mean, again to be correct)
so with some patience connecting to a LAN switch you could capture an STP frame and you could see the DSAP SSAP and other fields
So your book may have reported a sentence from an older book or it is old itself
Edit:
in the following link you can see a list of L2 signalling protocols like CDP, VTP, DTP and they use SNAP
http://www.cisco.com/en/US/products/hw/switches/ps700/products_white_paper09186a00801b49a4.shtml
Have a nice weekend
Hope to help
Giuseppe
05-08-2010 09:29 AM
Thanks Giusepppe. you too have a nice weekend.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide