1. Foreword
The network often encounters some words, such as packets, packets, and frames. The concepts are as follows:
1) Frame (frame): The protocol data unit of the data link layer, which includes three parts: frame header, data part, and frame tail. Among them, the frame header and frame tail contain some necessary control information, such as synchronization information, address information, error control information and so on.
2) Packet (packet): The data unit in the communication transmission of TCP/IP protocol, also called "packet". Refers to a self-contained packet with sufficient addressing information to be transmitted independently from a source host to a destination host without the need for an earlier exchange of information between the source host and the destination host and transmission of the network.
3) Message: It is the data unit exchanged and transmitted in the network, and also the unit of network transmission. The message contains the complete data information to be sent, and its length varies. During the transmission process, the message will be continuously encapsulated into groups, packets, and frames for transmission. The way of encapsulation is to add some control information, which is the message header.
To put it simply, switches interact with frames, routers interact with packets, and the application layer interacts with packets. What is actually transmitted in the network is actually a frame, and the message and packet feel more like a conceptual definition. This article is about the format of the next frame.
Two, the type of frame
From the development of Ethernet I to the present, there have been about 5 Ethernet frame formats (there must be more than one in practice, but we are not mainly discussing various versions of frames), which are as follows.
l Ethernet I: 1980 DEC, Intel, Xerox formulated the Ethernet I standard
l Ethernet II: 1982 DEC, Intel, and Xerox formulated the Ethernet II standard
(1982 IEEE began to study the international standard 802.3 of Ethernet)
l 802.3 RAW: In 1983, Novell couldn't wait to develop a dedicated Ethernet frame format based on the original version of IEEE 802.3. That is 802.3 RAW.
l 802.3 LLC: In 1985, IEEE launched the official version of 802.3, which mainly added the LLC control field, so it is also called 802.3 LLC.
l 802.3 SNAP: Later, a compromise SNAP format was introduced to solve the compatibility problem between Ethernet II and 802.3.
Generally speaking, Ethernet II was originally a standard formulated by several companies in partnership, and 802.3 was an official international standard issued by IEEE, but due to historical reasons, Ethernet II has become the standard that everyone actually follows.
802.3 RAW was developed by Novel based on the original version of IEEE, but because everyone didn't recognize it, only their family used it. LLC is an international standard officially launched by IEEE, and SNAP is launched for compatibility with Ethernet II. LLC and SNAP still have some advantages over Ethernet II, so these two frame formats are still used in specific scenarios.
Three, frame details
1、Ethernet I
Preamble and SFD (8 byte): The first 8 bytes (64 bit) are fixed values, the first 7 bytes are 10101010, and the 8th byte is 10101011, which looks like this:
10101010、10101010、10101010、10101010、10101010、10101010、10101010、10101011
Its role is to identify the starting position of the frame. When we discussed the OSI reference model earlier, we learned that a very important point in the Layer 2 protocol is the transmission of bit streams, 0 means low level and 1 means high level. Since the transmission rate is very fast, in order to ensure the accuracy of the data, we must use a very conspicuous mark to distinguish between the two frames before and after. The frame data uses 8 bytes (64 bits) to alternately send out 01 signals, which is a very, very conspicuous signal, which can avoid data confusion between the two frames before and after.
Dest Addr (6 bytes): Destination address, here refers to the MAC address, such as 54-89-98-A1-1B-BC.
Source Addr (6 bytes): Source address, also MAC address.
Type (2 bytes): type, identifying the upper layer protocol. For example, 0x0800 is the IP protocol, and 0x0806 is the ARP protocol.
Data (46-1500 byte): The transmitted data, such as the IP protocol message, is placed here.
FCS (4 byte): check digit
Inter Frame Gap: refers to the time interval between two frames before and after, not data.
2、Ethernet II
The frame format of Ethernet II is exactly the same as that of Ethernet I, the only difference is that II has updated the electrical characteristics and physical interface on the basis of I. And Ethernet II is currently the most widely used frame format and has become the frame standard of Ethernet in fact. However, 802.3 frames are still used in some specific places, so we have to continue to introduce them.
3、802.3 RAW
Compared with Ethernet I and II, 802.3 RAW uses the Length field instead of type, and removes 2 bytes from Data and assigns it to 0xFFFF. Of course, this is not for egg pain, but for historical reasons. As mentioned earlier, 802.3 RAW is a version launched by Novel on its temporary version before IEEE officially launched 802.3. In the interim version of 802.3, the Length field was used instead of the type field. Novel Company continued to use this setting, but when 802.3 was officially released, 3 bytes were moved from Data to be used as DSAP, SSAP, and Control fields (one byte each) , will be discussed below). In order to be compatible and differentiated from the official version of 802.3, RAW assigns the two fields of DSAP and SSAP to 0xFFFF, and at the same time, the Control field is still assigned back to Data. Next, let's talk about the meaning of each field.
4、802.3 LLC
As mentioned earlier, IEEE had a temporary version of the 802.3 protocol, which was used by Novel, in which the type field in Ethernet II was changed to Length, and 3 bytes were moved from the Data field in the official release to be used as DSAP, The SSAP and Control fields, collectively called the LLC header, are also used to identify the upper-layer protocol. So the official version of 802.3 is also called 802.3 LLC.
Length (2 byte): The byte length of subsequent data, but does not include the check code
DSAP (1 byte): destination service access point
SSAP (1 byte): source service access point
Control (1 byte): control field
The functions of the three fields DSAP, SSAP, and Control can be said to replace the type of Ethernet II and exceed the function of the type field. I haven't figured out what's going on. You can refer to: data link layer - know almost
5、802.3 SNAP
As mentioned earlier, SNAP is to make 802.3 LLC and Ethernet II compatible. The compatibility method is to reserve the four fields of Length, DSAP, SSAP, and Control, and at the same time remove 5 bytes from Data to use as the SNAP field.
The SNAP field is composed of 2 parts. The first 3 bytes are org code, which means the organization code. In fact, it is the first 3 bytes in the MAC address, so it is actually useless. The last 2 bytes are exactly the same as the type field of Ethernet II. In fact, it is also compatible with Ethernet II frames through the type field in this SNAP.
In addition, in order to distinguish it from the LLC frame, the values of DSAP and SSAP are fixed at 0xAA, and the value of Control is fixed at 0x03.
6. Summary
Let's do it again:
1) The Ethernet I and II frame formats are consistent, and the type field is used to record the upper layer protocol.
2) The 802.3 frame replaces the position of the original type field with the Length field, which means the data length of the frame. At the same time, 3 bytes are moved from the Data for the DSAP, SSAP, and Control fields. Its function is similar to that of the type field, which is also used for recording The upper layer protocol can be more refined.
3) The 802.3 RAW frame is a version of 802.3 that is still being researched and is only used by Novel. It is a bit similar to 802.3 in that there is no type field but a Length field. To distinguish it from the official version 802.3, set the original 802.3 DSAP and SSAP field values to 0xFF (the two fields together are 0xFFFF).
4) The 802.3 LLC frame is the official version of 802.3. The SDAP, SSAP, and Control fields are collectively called the LLC header, so the official 802.3 is also called 802.3 LLC to distinguish it from other frame formats. If you directly say 802.3, it generally refers to this version .
5) The 802.3 SNAP frame is 802.3. In order to be compatible with Ethernet II, it retains the Length field, and borrows 5 bytes from Data, of which 2 bytes are the type field, and the values of DSAP and SSAP are fixed at 0xAA. The value of Control is fixed at 0x03.
Fourth, the use of frames in the network
Ethernet II：
The Ethernet II frame is the most commonly used. We transmit any data randomly, and you can see that it is an Ethernet II frame when you capture the packet, such as the one in the figure below.
However, the Ethernet II frame is characterized by a type field but no Length field, so how does the network device know that the frame data transmission is over? The principle is that the "4B/5B" encoding is used in network transmission. I don't understand the specifics. Anyway, with this encoding rule, the network device can recognize the end of the frame.
802.3：
802.3 LLC is the official version of 802.3. The difference from Ethernet II is that it has an additional Length field and LLC control field (SDAP, SSAP, Control). According to the Internet, 802.3 LLC is relatively "controllable", so it is between switches When transmitting packets, for example, BPDU uses 802.3. I don’t quite understand it, but after capturing the packets, I found that it is indeed the case. For example, the BPUD packets of the STP protocol are 802.3 frames, as shown in the figure below.
How to distinguish between Ethernet II and 802.3:
As mentioned above, 802.3 has a Length field and Ethernet II has a type field, so these two fields have the same position in the frame but different values. Specifically, the maximum length of a frame is 1500 bytes, so the maximum value of the Length field is 0x05DC (1500 hexadecimal), so everyone agreed that the value of the type field must be greater than 0x0600 (for example, 0x800 is an IP frame , 0x0806 is an ARP frame), so that the two frame formats are successfully staggered.
802.3 RAW：
As mentioned earlier, RAW is used by Novel itself. The feature is that the Length field is used instead of the type but there is no LLC control field. In order to make a distinction, everyone agrees that the RAW frame is based on 802.3 LLC, and the values of the DSAP and SSAP positions are set to 0xFFFF. So when the Length field value is less than 0x0600 and the next two bytes are all F, it is a RAW frame. Since it's only used by Novel itself, we don't care about it.
802.3 SNAP：
SNAP is also modified on the basis of 802.3 LLC. The way to distinguish it is that its DSAP and SSAP fields have a fixed value of 0x0A. After searching for a long time, I didn't find any protocols that use SNAP-encapsulated frames, so I don't care.
V. Summary
This article briefly describes several commonly used frame formats, and finally found that we only need to relate Ethernet II and 802.3 LLC.