This wiki has been migrated to https://gitlab.com/wireshark/wireshark/-/wikis/home and is now deprecated. Please use that site instead.
Differences between revisions 1 and 5 (spanning 4 versions)
Revision 1 as of 2005-02-06 12:42:37
Size: 1265
Editor: UlfLamping
Comment:
Revision 5 as of 2006-06-05 03:19:18
Size: 1835
Editor: localhost
Comment:
Deletions are marked like this. Additions are marked like this.
Line 2: Line 2:
= Logical Link Control (LLC) = = Logical Link Control (LLC, IEEE 802.2) =
Line 12: Line 12:
 * ["Ethernet"]: Typically, LLC uses ["Ethernet"] as its transport protocol. LLC can use a number of LAN (and MAN/WAN?) protocols as its transport protocol:

 * ["Ethernet"]: LLC can be used for packets on ["Ethernet"] networks, although many protocols don't use it when running atop Ethernet.
 * ["IEEE 802.11"]: LLC is used for data packets on ["IEEE 802.11"] networks.
 * ["FDDI"]: LLC is used for data packets on ["FDDI"] networks.
 * TokenRing: LLC is used for data packets on TokenRing networks.
Line 16: Line 21:
XXX - Add example traffic here (as plain text or Ethereal screenshot). XXX - Add example traffic here (as plain text or Wireshark screenshot).
Line 18: Line 23:
== Ethereal == == Wireshark ==
Line 20: Line 25:
The LLC dissector is (XXX - fully functional, partially functional, not existing, ... whatever the current state is). The LLC dissector is fully functional.
Line 28: Line 33:
XXX - Add a simple example capture file to the SampleCaptures page and link from here. Keep it short, it's also a good idea to gzip it to make it even smaller, as Ethereal can open gzipped files automatically. XXX - Add a simple example capture file to the SampleCaptures page and link from here. Keep it short, it's also a good idea to gzip it to make it even smaller, as Wireshark can open gzipped files automatically.
Line 31: Line 36:
A complete list of LLC display filter fields can be found in the [http://www.ethereal.com/docs/dfref/l/llc.html display filter reference] A complete list of LLC display filter fields can be found in the [http://www.wireshark.org/docs/dfref/l/llc.html display filter reference]
Line 38: Line 43:
XXX - add info how LLC can be filtered The way you capture only LLC-based protocols depends on the link-layer type of the network on which you're capturing.

XXX: Ethernet - look for packets with a length field, and maybe worry about IPX-over-raw-802.3; Token Ring, FDDI, and 802.11, check for data packets.
Line 42: Line 49:
 * add link to LLC specification and where to find additional info on the web about LLC  * [http://standards.ieee.org/getieee802/802.2.html IEEE 802.2 specification]
 * [http://ckp.made-it.com/ieee8022.html IEEE 802.2 LLC]

Logical Link Control (LLC, IEEE 802.2)

XXX - add a brief LLC description here

History

XXX - add a brief description of LLC history

Protocol dependencies

LLC can use a number of LAN (and MAN/WAN?) protocols as its transport protocol:

  • ["Ethernet"]: LLC can be used for packets on ["Ethernet"] networks, although many protocols don't use it when running atop Ethernet.
  • ["IEEE 802.11"]: LLC is used for data packets on ["IEEE 802.11"] networks.
  • ["FDDI"]: LLC is used for data packets on ["FDDI"] networks.
  • TokenRing: LLC is used for data packets on TokenRing networks.

Example traffic

XXX - Add example traffic here (as plain text or Wireshark screenshot).

Wireshark

The LLC dissector is fully functional.

Preference Settings

(XXX add links to preference settings affecting how LLC is dissected).

Example capture file

XXX - Add a simple example capture file to the SampleCaptures page and link from here. Keep it short, it's also a good idea to gzip it to make it even smaller, as Wireshark can open gzipped files automatically.

Display Filter

A complete list of LLC display filter fields can be found in the [http://www.wireshark.org/docs/dfref/l/llc.html display filter reference]

  • Show only the LLC based traffic:

     llc 

Capture Filter

The way you capture only LLC-based protocols depends on the link-layer type of the network on which you're capturing.

XXX: Ethernet - look for packets with a length field, and maybe worry about IPX-over-raw-802.3; Token Ring, FDDI, and 802.11, check for data packets.

Discussion

LLC (last edited 2008-04-12 17:51:45 by localhost)