Ethernet frame IG/LG bit explanation - Wireshark

Question

I have a screenshot of an ethernet packet frame from Wireshark.

I need to explain what is the meaning of these marked lines (with dots and zeros). I searched in web, but still I don't have an answer.

Thanks!

Answer 1

Both the LG bit (sometimes also referred to as UL bit) and the IG bit are located in the most significant byte of each MAC address, where the IG bit is the least significant bit in this byte and the LG bit is the second least significant bit in this byte.

The IG bit distinguishes whether the MAC address is an individual or group (hence IG) address. In other words, an IG bit of 0 indicates that this is a unicast MAC address, an IG bit of 1 indicates a multicast or broadcast address.

The LG or UL bit on the other hand distinguishes vendor assigned and administratively assigned MAC addresses. When you administratively change the MAC address of your device to another address, then you should set this bit to one. Many drivers and cards however do not enforce this, and I do not know one application which really relies on this one.

So the vast majority of cases (except for broadcast messages) you will see both bits set to 0 (unicast and vendor assigned), as can be confirmed in your screenshot.

Answer 2

Ethernet is defined by the IEEE 802 standards. These are available for free through the IEEE GET Program, but you must login with an IEEE account. Here's a copy-paste from the 802 "Overview and Architecture" document, Chapter 8 (MAC addresses):

... the least significant bit (LSB) of the first octet is the individual/group (I/G) address bit. The next-to-LSB of the first octet for the assignment is the universal/local (U/L) address bit.

As waza-ari noted, Wireshark uses the alternative "LG" notation for the U/L bit.

The I/G address bit is used to identify the destination MAC address as an individual MAC address or a group MAC address. If the I/G address bit is 0, it indicates that the MAC address field is an individual MAC address. If this bit is 1, the MAC address is a group MAC address that identifies one or more (or all) stations connected to the IEEE 802 network. The all-stations broadcast MAC address is a special group MAC address of all 1’s

The U/L bit indicates whether the MAC address has been assigned by a local or universal administrator. Universal addresses have the U/L bit set to 0. If the U/L bit is set to 1, the remaining bits (i.e., all bits except the I/G and U/L bits) are locally administered and should not be expected to meet the uniqueness requirement of the IEEE RA-assigned values.

When U/L (LG) is set to 0, the first 3 octets (24 bits) of a MAC address are known as an OUI (Organisationally Unique Identifier). As you can see in your screenshot, Wireshark looks up the OUI in a table maintained by the IEEE Registration Authority (also freely available) and displays the organisation name. In this case 0x0017C4 = "Quanta Microsystems, INC."

When U/L (LG) is set to 0, the MAC address must be globally unique. When U/L (LG) is set to 1, the MAC address must be LOCALLY unique. i.e. The uniqueness does not need to extend beyond a router.

So, waza-ari is wrong in one respect: the U/L (LG) bit is important.