Ethereal-users: [Ethereal-users] "Type/Lenght" field in Ethernet II and Ethernet 802.3 frames

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: teresita@xxxxxxxxxxxxx
Date: Fri, 28 May 2004 11:44:48 +0100
Dear Ethereal users,

First of all excuse me if this might be a bit off-topic.

I'm studying ethernet fundamentals and I know the following facts : 

1- Ethernet II frames have a 2-byte field called "Type"
2- Ethernet IEEE 802.3 frames have a 2-byte field called "Type/Lenght"
   2a.- If the "Type/Lenght" field contains a number higher than
0x600 Hex that means type (IP, IPX, whatever) if it's lower it means
the lenght of the data field.

Then here come two questions :

A) How does the network driver/libpcap/ethereal know where the data
field of an Ethernet II frame ends ? 

I'm asking because there's no "lenght" field, so it has to guess it
somehow.

B) How does the network driver/libpcap/ethereal know which is the
type of the data field on an IEEE 802.3 frame if the "Type/Lenght"
field is below 0x600 HEX ?

Thanks in advance,

Cheers,
Teresa