Parsing 802.1Q encapsulated Ethernet frame

[vijnaana47711]

Hi Folks

Since the vlan tag field is inserted between SA and type fields, how would one know whether an ethernet frame has vlan tag or not? Normally the type field comes after the SA field and we can determine the type easily, but with type field coming after the vlan tag, how does we know about the 802.1Q encapsulation?

Thanks

[Georg Pauwen]

Hello,

what are you after exactly ? You would need a protocol analyzer such as WireShark to identify the Vlan ID in the Ethernet frame, as described in the link below:

https://wiki.wireshark.org/VLAN

[vijnaana47711]

Hi Georg,

I was referring to parsing in C code.

Thanks

[Giuseppe Larosa · Accepted solution]

Hello Vijnaana47711,

actually the 4 bytes used by 802.1Q have the first two bytes that are an ethertype typically 0x8100 (other values are used in Carrier ethernet scenario for some complex services ).

The last two bytes provide the vlan-id (using 12 bits) the CoS (using 3 bits) and a canonical format indicator (1 bit depends on L2 technology).

see

https://en.wikipedia.org/wiki/EtherType

So a switch can easily understand when a frame is actually an 802.1Q tagged frame by looking at the first ethertype just after the MAC SA.

Hope to help

Giuseppe