Wireshark · Ethereal-users: Re: [Ethereal-users] "Type/Lenght" field in Ethernet II and Ethernet802.3 frames

["Ronnie Sahlberg" <ronnie_sahlberg@xxxxxxxxxxxxxx>]

Sent: Friday, May 28, 2004 8:44 PM
Subject: [Ethereal-users] "Type/Lenght" field in Ethernet II and
Ethernet802.3 frames


>
> Dear Ethereal users,
>
> First of all excuse me if this might be a bit off-topic.
>
> I'm studying ethernet fundamentals and I know the following facts :
>
> 1- Ethernet II frames have a 2-byte field called "Type"
> 2- Ethernet IEEE 802.3 frames have a 2-byte field called "Type/Lenght"
>    2a.- If the "Type/Lenght" field contains a number higher than
> 0x600 Hex that means type (IP, IPX, whatever) if it's lower it means
> the lenght of the data field.
>
> Then here come two questions :
>
> A) How does the network driver/libpcap/ethereal know where the data
> field of an Ethernet II frame ends ?
>
> I'm asking because there's no "lenght" field, so it has to guess it
> somehow.

The NIC knows where it ends because when the bits stop coming in on the
wire, that is where the frame ends.


>
> B) How does the network driver/libpcap/ethereal know which is the
> type of the data field on an IEEE 802.3 frame if the "Type/Lenght"
> field is below 0x600 HEX ?

It knows by looking at this field and checking if it is less than 0x600 or
not.