Differences between revisions 5 and 6
Revision 5 as of 2004-09-25 08:56:39
Size: 2448
Editor: UlfLamping
Comment: add some more descriptive text
Revision 6 as of 2004-09-25 09:15:56
Size: 2877
Editor: UlfLamping
Comment:
Deletions are marked like this. Additions are marked like this.
Line 8: Line 8:
Ethernet sends network packets from the sending host to one or more receiving hosts. The hosts are addressed by their MAC addresses, a 6 byte number usually displayed as: 08:00:08:15:ca:fe (the delimiters vary, so you might see 08-00-08-15-ca-fe or alike). Ethernet sends network packets from the sending host to one or more receiving hosts.
Line 10: Line 10:
A destination address of ff:ff:ff:ff:ff:ff indicates a ["Broadcast"], meaning the packet is send from one host to any other on that network. An Ethernet host is addressed by it's Ethernet MAC address, a 6 byte number usually displayed as: 08:00:08:15:ca:fe (the delimiters vary, so you might see 08-00-08-15-ca-fe or alike). The first three bytes of the address are assigned to a specific vendor, see [http://www.iana.org/assignments/ethernet-numbers Ethernet numbers] at the ["IANA"] for assigned and special addresses.

A destination MAC address of ff:ff:ff:ff:ff:ff indicates a ["Broadcast"], meaning the packet is send from one host to any other on that network.
Line 21: Line 23:

An Ethernet packet will look like:

|| Preambel || Destination MAC address || Source MAC address || Type || User Data || Frame Check Sequence (FCS) ||
||<:#FF8080> 8 ||<:> 6 ||<:> 6 ||<:> 2 ||<:> x ||<:> 4 ||

Ethernet (IEEE 802.3)

Ethernet is the most common local area networking technology, and, with gigabit and 10 gigabit Ethernet, is also being used for metropolitan-area and wide-area networking.

It is specified by [http://standards.ieee.org/getieee802/802.3.html various IEEE 802.3 specifications].

Ethernet sends network packets from the sending host to one or more receiving hosts.

An Ethernet host is addressed by it's Ethernet MAC address, a 6 byte number usually displayed as: 08:00:08:15:ca:fe (the delimiters vary, so you might see 08-00-08-15-ca-fe or alike). The first three bytes of the address are assigned to a specific vendor, see [http://www.iana.org/assignments/ethernet-numbers Ethernet numbers] at the ["IANA"] for assigned and special addresses.

A destination MAC address of ff:ff:ff:ff:ff:ff indicates a ["Broadcast"], meaning the packet is send from one host to any other on that network.

XXX - also describe multicast.

Ethernet uses a 16bit type field to indicate which upper layer protocol should be used. Some examples:

  • 0 - 45 invalid
  • 46 - 1500 length field (Ethernet-II)
  • 0x0800 IP(V4), internet protocol version 4
  • 0x0806 ARP, address resolution protocol
  • 0x8137 IPX, internet packet exchange (Novell)

An Ethernet packet will look like:

Preambel

Destination MAC address

Source MAC address

Type

User Data

Frame Check Sequence (FCS)

8

6

6

2

x

4

History

XXX - add a brief description of Ethernet history

Protocol dependencies

  • Ethernet is the lowest software layer, so it only depends on hardware.

Example traffic

XXX - Add example traffic here (as plain text or Ethereal screenshot).

Ethereal

The Ethernet dissector is fully functional.

Preference Settings

(XXX add links to preference settings affecting how Ethernet is dissected).

Example capture file

XXX - Add a simple example capture file. Keep it short, it's also a good idea to gzip it to make it even smaller, as Ethereal can open gzipped files automatically.

Display Filter

A complete list of Ethernet display filter fields can be found in the [http://www.ethereal.com/docs/dfref/e/eth.html display filter reference]

  • Show only the Ethernet-based traffic:

     eth 

    Show only the Ethernet-based traffic to and from Ethernet MAC address 08:00:08:15:ca:fe:

     eth.addr==08.00.08.15.ca.fe 

Capture Filter

  • Capture only the Ethernet-based traffic to and from Ethernet MAC address 08:00:08:15:ca:fe:

     ether host 08:00:08:15:ca:fe 

Discussion

Ethernet (last edited 2011-04-25 22:24:29 by BillMeier)