Ethereal-users: Re: [Ethereal-users] "Type/Lenght" field in Ethernet II andEthernet802.3 frames
----- Original Message -----
From: "Jack Jackson"
Sent: Saturday, May 29, 2004 1:54 PM
Subject: Re: [Ethereal-users] "Type/Lenght" field in Ethernet II
andEthernet802.3 frames
> At 03:11 PM 5/28/2004, Ronnie Sahlberg wrote:
>
> >Sent: Friday, May 28, 2004 8:44 PM
> >Subject: [Ethereal-users] "Type/Lenght" field in Ethernet II and
> >Ethernet802.3 frames
> >
> >
> > >
> > > Dear Ethereal users,
> > >
> > > First of all excuse me if this might be a bit off-topic.
> > >
> > > I'm studying ethernet fundamentals and I know the following facts :
> > >
> > > 1- Ethernet II frames have a 2-byte field called "Type"
> > > 2- Ethernet IEEE 802.3 frames have a 2-byte field called "Type/Lenght"
> > > 2a.- If the "Type/Lenght" field contains a number higher than
> > > 0x600 Hex that means type (IP, IPX, whatever) if it's lower it means
> > > the lenght of the data field.
> > >
> > > Then here come two questions :
> > >
> > > A) How does the network driver/libpcap/ethereal know where the data
> > > field of an Ethernet II frame ends ?
> > >
> > > I'm asking because there's no "lenght" field, so it has to guess it
> > > somehow.
> >
> >The NIC knows where it ends because when the bits stop coming in on the
> >wire, that is where the frame ends.
>
> But the frame length is not interesting, since short messages may be
padded
> depending on the medium. If there is no length in the Ethernet header
then
> the protocol under the header needs to have some kind of length in it.
That is a correct conclusion. And those protocols do provide the length of
their own payload themself or they suffer.
The question was about ethernetII however and in ethernetII the length of
the ethernetII frame is determined
by when the bits stop arriving off the wire.
