2

I have a network switch IC , and I am using to the send BPDU packet. I can send packet with 2 byte ethertype/length field like this : 81 00, 80 00, 91 00 and some special hex number. But if I try to this field like this 00 27 . Switch drop the frame because of this "00 27" number.

Is this a rule for the some special switch ? Why the ethertype/length field cant be any number to pass the switch. I looked in the datasheet, there is no topic about this. (By the way VLAN feature close)

|improve this question
4

There are multiple types of Ethernet frames. The common ones today are Ethernet-II and 802.3 ethernet.

They both start the same but diverge when they get to the ethertype/length field. From Wikipedia "Ethernet frame"

Ethernet Frame format from Wikipedia

The "Ethertype or length" field is how you tell whether it is EthernetII or 802.3. If the field is less than 1500 then it means that the frame is 802.3 and the field specifies the length.

So when you put 0x0027 in that field, you are saying that your frame is 802.3 ethernet and it's length is 39 octets. That also means you can expect a LLC header immediately after the length field.

802.3 ethernet header format from geeksforgeeks.com. The DSAP/SSAP fields specify the content for 802.3. Not the length field (which you thought was the Ethertype field).

enter image description here

Here's a picture of a wireshark capture of a spanning tree frame. The length field is 0x0027 (decimal 39). It's followed by the DSAP and SSAP fields of 0x42 indicating spanning tree, then a control field, before you get to the data.

enter image description here

The other thing to realize is that switches LISTEN to spanning tree. They process the frame. Spanning tree frames are intended for switches. So if you send a correctly formatted spanning tree frame to a switch, it will consume the frame and update the spanning tree application state on the switch accordingly (which may trigger other spanning tree BPDU's to be sent).

And if you send an incorrect spanning tree BPDU to a switch, it will drop it because it's supposed to process it, but it's wrong.

|improve this answer
  • 1
    A switch doesn't usually care about an LLC header. EtherType values of 1501-1535 are undefined by standard, so interpretation can vary. – Zac67 Feb 13 at 8:10
  • Thank you for your help – NetworkStudent Feb 13 at 9:10
  • 1
    Ethernet II is older than 802.3! – grahamj42 Feb 13 at 15:09
  • @grahamj42 Thank you. Corrected. Learn something new every day 😀 (I made an incorrect assumption after running into STP and CDP in 802.3 format) – Darrell Root Feb 13 at 16:35
3

An EtherType/Length value up to 1500 (0x05dc) indicates the frame's payload length. The values 1501-1535 (0x05dd-0x05ff) are undefined, real Ethertype values start at 1536 (0x600).

The receiving switch is probably ignoring the rest of the frame and since the supposed FCS doesn't match, it drops the error frame.

You'll need to use a larger value and take care that your private EtherType doesn't collide with anything already in use.

|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.