Differences between revisions 1 and 6 (spanning 5 versions)
Revision 1 as of 2004-09-09 08:05:14
Size: 434
Editor: adsl-209-204-185-249
Comment: Add an Ethernet page with some links.
Revision 6 as of 2004-09-25 09:15:56
Size: 2877
Editor: UlfLamping
Comment:
Deletions are marked like this. Additions are marked like this.
Line 1: Line 1:
##language:en
= Ethernet (IEEE 802.3) =
Line 5: Line 8:
A lot of tutorial information about Ethernet can be found at [http://www.ethermanage.com/ethernet/ethernet.html Charles Spurgeon's Ethernet Web Site]. Ethernet sends network packets from the sending host to one or more receiving hosts.

An Ethernet host is addressed by it's Ethernet MAC address, a 6 byte number usually displayed as: 08:00:08:15:ca:fe (the delimiters vary, so you might see 08-00-08-15-ca-fe or alike). The first three bytes of the address are assigned to a specific vendor, see [http://www.iana.org/assignments/ethernet-numbers Ethernet numbers] at the ["IANA"] for assigned and special addresses.

A destination MAC address of ff:ff:ff:ff:ff:ff indicates a ["Broadcast"], meaning the packet is send from one host to any other on that network.

XXX - also describe multicast.

Ethernet uses a 16bit type field to indicate which upper layer protocol should be used. Some examples:

 * 0 - 45 invalid
 * 46 - 1500 length field (Ethernet-II)
 * 0x0800 IP(V4), internet protocol version 4
 * 0x0806 ARP, address resolution protocol
 * 0x8137 IPX, internet packet exchange (Novell)

An Ethernet packet will look like:

|| Preambel || Destination MAC address || Source MAC address || Type || User Data || Frame Check Sequence (FCS) ||
||<:#FF8080> 8 ||<:> 6 ||<:> 6 ||<:> 2 ||<:> x ||<:> 4 ||


== History ==

XXX - add a brief description of Ethernet history

== Protocol dependencies ==

 * Ethernet is the lowest software layer, so it only depends on hardware.

== Example traffic ==

XXX - Add example traffic here (as plain text or Ethereal screenshot).

== Ethereal ==

The Ethernet dissector is fully functional.

== Preference Settings ==

(XXX add links to preference settings affecting how Ethernet is dissected).

== Example capture file ==

XXX - Add a simple example capture file. Keep it short, it's also a good idea to gzip it to make it even smaller, as Ethereal can open gzipped files automatically.

== Display Filter ==
A complete list of Ethernet display filter fields can be found in the [http://www.ethereal.com/docs/dfref/e/eth.html display filter reference]

 Show only the Ethernet-based traffic: {{{
 eth }}}

 Show only the Ethernet-based traffic to and from Ethernet MAC address 08:00:08:15:ca:fe: {{{
 eth.addr==08.00.08.15.ca.fe }}}

== Capture Filter ==

 Capture only the Ethernet-based traffic to and from Ethernet MAC address 08:00:08:15:ca:fe: {{{
 ether host 08:00:08:15:ca:fe }}}

== External links ==

 * A lot of tutorial information about Ethernet can be found at [http://www.ethermanage.com/ethernet/ethernet.html Charles Spurgeon's Ethernet Web Site].

== Discussion ==

Ethernet (IEEE 802.3)

Ethernet is the most common local area networking technology, and, with gigabit and 10 gigabit Ethernet, is also being used for metropolitan-area and wide-area networking.

It is specified by [http://standards.ieee.org/getieee802/802.3.html various IEEE 802.3 specifications].

Ethernet sends network packets from the sending host to one or more receiving hosts.

An Ethernet host is addressed by it's Ethernet MAC address, a 6 byte number usually displayed as: 08:00:08:15:ca:fe (the delimiters vary, so you might see 08-00-08-15-ca-fe or alike). The first three bytes of the address are assigned to a specific vendor, see [http://www.iana.org/assignments/ethernet-numbers Ethernet numbers] at the ["IANA"] for assigned and special addresses.

A destination MAC address of ff:ff:ff:ff:ff:ff indicates a ["Broadcast"], meaning the packet is send from one host to any other on that network.

XXX - also describe multicast.

Ethernet uses a 16bit type field to indicate which upper layer protocol should be used. Some examples:

  • 0 - 45 invalid
  • 46 - 1500 length field (Ethernet-II)
  • 0x0800 IP(V4), internet protocol version 4
  • 0x0806 ARP, address resolution protocol
  • 0x8137 IPX, internet packet exchange (Novell)

An Ethernet packet will look like:

Preambel

Destination MAC address

Source MAC address

Type

User Data

Frame Check Sequence (FCS)

8

6

6

2

x

4

History

XXX - add a brief description of Ethernet history

Protocol dependencies

  • Ethernet is the lowest software layer, so it only depends on hardware.

Example traffic

XXX - Add example traffic here (as plain text or Ethereal screenshot).

Ethereal

The Ethernet dissector is fully functional.

Preference Settings

(XXX add links to preference settings affecting how Ethernet is dissected).

Example capture file

XXX - Add a simple example capture file. Keep it short, it's also a good idea to gzip it to make it even smaller, as Ethereal can open gzipped files automatically.

Display Filter

A complete list of Ethernet display filter fields can be found in the [http://www.ethereal.com/docs/dfref/e/eth.html display filter reference]

  • Show only the Ethernet-based traffic:

     eth 

    Show only the Ethernet-based traffic to and from Ethernet MAC address 08:00:08:15:ca:fe:

     eth.addr==08.00.08.15.ca.fe 

Capture Filter

  • Capture only the Ethernet-based traffic to and from Ethernet MAC address 08:00:08:15:ca:fe:

     ether host 08:00:08:15:ca:fe 

Discussion

Ethernet (last edited 2020-06-29 17:39:11 by ChuckCraft)