ISL vs Dot1q header

[parthrawat979]

So I found a wireshark capture and I want to differentiate between the ISL and the Dot1q header.
Here is the direct link of the capture: https://wiki.wireshark.org/uploads/__moin_import__/attachments/SampleCaptures/isl-2-dot1q.cap

You can find it here
https://wiki.wireshark.org/samplecaptures

[Cristian Matei]

Hi,

   And what is your challenge? What is the question(s) you'd like to get answers for?

Thanks,

Cristian.

[parthrawat979]

We know that isl uses snap header so I want to see that. I can see the same snap info in both the isl and dot1q encapsulation??

[M02@rt37]

Hello @parthrawat979 

you will see the same snap info in packet captures for both encaps! The difference between isl and dot1q is where the vlan tagging happen... not the upper encapsulation! ISL wraps the entire ethernet frame with a cisco header and trailer, whil dot1q inserts the 4-byte tag inside the ethernet frame, but above that, the LLC/snap header is identical... that's why it looks the same in both cases.

[Cristian Matei]

Hi,

   The LLC header, being the upper portion of the data link layer per IEEE 802.2 specifications, and consisting of DSAP (Destination Service Access point) and SSAP (Source Service Access Point) will always be present. So difference between ISL and 802.1q does not relate to LLC header presence, rather on how the received frame is being encapsulated in the case of ISL or an additional set of fields is injected in the case of 802.1q:

https://ipwithease.com/wp-content/uploads/2020/06/ISL-vs-DOT1Q-TABLE-1.jpg

Thanks,

Cristian.

[parthrawat979]

LEN AAAA03(snap) these fields can't be seen in those captures. And why the LLC is there??

[Cristian Matei]

Hi,

    I've previously explained why LLC is there, if you want a more detailed explanation take a look at first URL, if you want something more in depth take a look at second URL:

https://www.cisco.com/c/en/us/support/docs/ibm-technologies/logical-link-control-llc/12247-45.html

https://www.ieee802.org/3/cm_study/email/pdf00000.pdf

SNAP is 0xAA and it's present, as expected, for 802.1q frames, it also shows up in the packet capture you've provided.

Thanks,

Cristian.

[Joseph W. Doherty]

As a side question, where are you seeing ISL traffic?

I'm not positive, but I recall (???) latest Cisco IOSs no longer support ISL.

[parthrawat979]

I think it's some old captures at the link I mentioned above.