5

I am parsing an ethernet dataframe.

It has the form : (destination_mac_6_bytes) + (source_mac_6_bytes) + (ether_type_2_bytes).

Usually, I see ethertype like Ox86dd (IPv6).

But I came across this etherType: Ox0036.

The destination mac address was 1:80:c2:0:0:0. The source mac address was the one of the router.

Does anyone know what this is? I couldn't find any reference for this on the internet. Maybe it's not an EtherType, but then what is it?

Thanks

  • One hint could be the source MAC address and the node sending those Ethertype frames. Care to show us the dump? – Zac67 Jan 23 at 21:39
  • 2
    That is actually a length field if it is smaller than decimal 1501. That means it is not an Ethernet II frame, but an 802.3 frame. – Ron Maupin Jan 23 at 21:50
  • Thanks for your answers. The packet looked like this: 1:80:c2:0:0:0 0:7:d4:a1:aa 0x00 0x36 0x42 0x42 – DevShark Jan 23 at 21:56
  • That's an IEEE 802 bridge group address. 99% of the time, it's spanning-tree. (the remaining 1% is often 802.1x authentication.) – Ricky Beam Jan 24 at 4:05
  • Thanks a lot, I’ll look into thats. – DevShark Jan 24 at 7:25
6

Does anyone know what this is?

As Ron Maupin already wrote, "EtherType" fields with values up to 1500 are interpreted as "length of the data", which is the number of valid data bytes following the EtherType field. ("valid" means: Not including padding bytes at the end of the frame).

0x0036 means that 54 data bytes are following the "EtherType" field.

However, the frame is not necessarily an 802.3 frame but it may also be an 802.2 frame.

If you want to know which type of packet it is, there are the following possibilities:

1) 802.3

802.3 frames contain no information about the packet type carried. There is also no possibility that allows distinguishing 802.2 and 802.3 packets with certainty.

This means that the destination computer must either be able to distinguish the packet type from the payload data or only one single layer-3 protocol (using EtherType fields up to 1500) must be used in the Ethernet network.

Linux (for example) uses the following assumption:

If the two data bytes following the EtherType field are 0xFF 0xFF, these two bytes are the first two bytes of an IPX packet; otherwise the Ethernet frame is an 802.2 frame (see below).

2) 802.2 (LLC)

(See Wikipedia entry)

802.2 frames have an extra header of 3 or 4 bytes length between the EtherType field and the actual data. The EtherType field contains the length of the data including these 3 or 4 bytes.

In the most common case, the first byte after the EtherType field is an even value describing the packet type, which is followed by a byte with the same value or the value plus 1.

Example: If the EtherType is followed by 0xF0 0xF0 or 0xF0 0xF1, the packet is a NetBEUI packet; if it is followed by 0xE0 0xE0, it is an IPX packet.

If the two low bits of the 3rd byte are both set, the extra header is 3 bytes long; otherwise it is 4 bytes long.

3) SNAP

If the two bytes after the "EtherType" field are 0xAA 0xAA (maybe also 0xAA 0xAB), the 3- or 4-byte 802.2 (LLC) extra header is followed by the 40-bit packet type. This may either be an EtherType value (the first 3 bytes are zero) or a manufacturer specific value (the first 3 bytes are the manufacturer code).

Examples (data bytes following the EtherType field):

  • 0xAA 0xAA 0x03 0x00 0x00 0x00 0x86 0xDD ...:

    EtherType = 0x86DD (IPv6)

  • 0xAA 0xAB 0x01 0x46 0x00 0x11 0x22 0x12 0x34 ...

    Proprietary protocol type 0x1234 of the manufacturer 00:11:22

5

For 802.3 ethernet, you have the length, not EtherType field. The Ethernet II did not have that, but used the field as an EtherType. Because the ethernet MTU is defined as 1500 (0x05DC), the EtherType values at decimal 1536 (0x0600). Any value at or below decimal 1500 means it is the 802.3 ethernet using a length value.

  • Thanks! Do you have a reference to this older ethernet protocol by any chance? I need to know where the etherType value is. Also does it make sense that the network would use both old and new ethernet protocols? – DevShark Jan 23 at 22:00
  • There is no EtherType in the 802.3 version of ethernet. Simply search for Ethernet II. There are devices that still run the 802.3 ethernet. It is rare to find something like you did, but there are also a lot of people that are playing with programmable chips and really do not understand what they are doing. – Ron Maupin Jan 23 at 22:02
  • @DevShark, look at the timeline of ethernet: en.wikipedia.org/wiki/IEEE_802.3 – Ron Maupin Jan 23 at 22:05
  • Thanks for that. I see indeed that the length is stored on 2 bytes, there's no ethertype and them directly the payload. I am a bit confused though, how am I supposed to make sense of the payload if I don't know what etherType it is? Also, should I be worried to see this old frame on a very simple network with only a modern computer and a modern router? – DevShark Jan 23 at 22:08
  • Things were much simpler in the old days, and ethernet was originally designed as a LAN protocol without regard for other protocols on top of it. You can look at the payload to see if it is an IP version. Maybe you have a printer that has other protocols than IP that have not been disabled. That is common, and you may see IPX, etc. on the LAN. – Ron Maupin Jan 23 at 22:15
4

Destination MAC address 01:80:c2:00:00:00 is used by spanning tree protocol and is the old 802.3 Ethernet format as Ron answered. Wireshark does a good decode. Logical link control field 0x42 comes after the length field confirming STP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.