Ethereal-users: Re: [Ethereal-users] "Type/Lenght" field in Ethernet II and Ethernet802.3 frames

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Jack Jackson <jack@xxxxxxxxxxxxxxx>
Date: Fri, 28 May 2004 20:54:14 -0700
At 03:11 PM 5/28/2004, Ronnie Sahlberg wrote:


Sent: Friday, May 28, 2004 8:44 PM
Subject: [Ethereal-users] "Type/Lenght" field in Ethernet II and
Ethernet802.3 frames


>
> Dear Ethereal users,
>
> First of all excuse me if this might be a bit off-topic.
>
> I'm studying ethernet fundamentals and I know the following facts :
>
> 1- Ethernet II frames have a 2-byte field called "Type"
> 2- Ethernet IEEE 802.3 frames have a 2-byte field called "Type/Lenght"
>    2a.- If the "Type/Lenght" field contains a number higher than
> 0x600 Hex that means type (IP, IPX, whatever) if it's lower it means
> the lenght of the data field.
>
> Then here come two questions :
>
> A) How does the network driver/libpcap/ethereal know where the data
> field of an Ethernet II frame ends ?
>
> I'm asking because there's no "lenght" field, so it has to guess it
> somehow.

The NIC knows where it ends because when the bits stop coming in on the
wire, that is where the frame ends.
But the frame length is not interesting, since short messages may be padded depending on the medium. If there is no length in the Ethernet header then the protocol under the header needs to have some kind of length in it.