I need to capture UDP information coming to me via an Ethernet frame. I have a point to point connection by fiber with 1000BASE-X Ethernet. The information coming to me is in GMII format; which is bytes at a rate of 125 MHz.

The UDP header format is shown below.

              0      7 8     15 16    23 24    31  
             |     Source      |   Destination   | 
             |      Port       |      Port       | 
             |                 |                 | 
             |     Length      |    Checksum     | 
             |                                   |   
             |          data octets              |

Source Port = SP Destination Port = DP Length = L Checksum = CS

For reference, the Ethernet frame is shown below.

    |  Preamble |  SFD  |   DA    |   SA    |   TL   | Data (Payload)   | CRC-32  | 
    |  6 bytes  |1 Byte | 6 bytes | 6 bytes |2 bytes | 46 to 1500 bytes | 4 bytes |

Assuming that my data will be placed in the Data (Payload) field of the Etnernet frame, my question is:

1) Will the order of the double bytes be, first DP, second SP, third CS, fourth L, fifth data byte1, sixth data byte2, etc.? 2) Least significant bytes first?

  • 1
    Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Commented Feb 19, 2018 at 2:56

1 Answer 1


You are missing a network layer:

  • Layer-1/2: ethernet
  • Layer-3: IPv4 or IPv6
  • Layer-4: UDP

The payload of the ethernet frames will probably be either IPv4 or IPv6 packets. You need to check the ethernet frame header EtherType field to determine what, specifically the payload is.

UDP datagrams will be the payload of either IPv4 or IPv6 packets. You can check the IPv4 packet header Protocol field, or the IPv6 header Next Header field to determine the payload of the IP packets.

As far as the byte order goes, the IETF has a Network Byte Order:

1.1. Background and Motivation

The document "ON HOLY WARS AND A PLEA FOR PEACE" [IEN-137] written in 1980 argues that the industry should settle on a single byte order. Since then, the IETF has largely settled on a single byte order known as "Network Byte Order" and this memo is intended to record that rough concensus. Unfortunately, the "holy war" continues among CPU manufacturers.

2. Definition of Network Byte Order

When a number is too large to fit in a single byte, multiple bytes are used to encode that number. When such numbers are sent over a byte-oriented protocol (e.g., TCP is 8-bit-byte oriented) an order for the bytes must be selected so both ends interpret the numbers in the same way independent of CPU architecture. When the bytes which make up such multi-byte numbers are ordered from most significant byte to least significant byte, that is called "network byte order" or "big endian."

For example, take the unsigned hexidecimal number 0xFEEDFACE (decimal 4,277,009,102). If this is sent as a sequence of 8-bit bytes using network byte order (big endian), the sequence would be: 0xFE, 0xED, 0xFA, 0xCE. In little endian (least significant byte to most significant byte), this would be: 0xCE, 0xFA, 0xED, 0xFE.

For ethernet, and other IEEE LANs, the destination address comes first, but for IPv4, IPv6, TCP, UDP, and other IETF standards, the source address comes first.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.