sniffer_培训101.ppt

Sniffer? University Introduction and Concepts Network Analysis and Troubleshooting Version 4.0 ? 2007 Network General Corporation. All Rights Reserved * File: Ethernet-frame.cap Although Ethernet version 2 pre-dates IEEE specs, the IEEE now recognizes the use of Ethertype as a standard implementation. Field Length Contents Preamble 64 bits synchronization DA 6 bytes MAC address of destination node SA 6 bytes MAC address of source node Type 2 bytes Specifies upper-layer protocol Data 46-1500 Data link layer views all information handed to it by higher layers as data, whether it is protocol information or user data FCS 4 bytes Frame Check Sequence (FCS) Sniffer? University Introduction and Concepts Network Analysis and Troubleshooting Version 4.0 ? 2007 Network General Corporation. All Rights Reserved * File: 802-3-frame.cap IEEE = Institute of Electronics and Electrical Engineers () Stations know if a frame is Version 2 or 802.3 by evaluating the 2 bytes following the source address. If they are greater than 05DC hex (1500 decimal), then the frame is Version 2; if they are equal to or less, they are assumed to be a length field. When the IEEE published the 802.3 standard, they revised the labels of the 8 bytes preceding the Destination Address although the binary pattern remained unchanged. The first seven bytes were called the Preamble. The eighth byte was called the Start Frame Delimiter (SFD). Field Length Contents Preamble 56 bits synchronization SFD 1 byte Start Frame Delimiter (transition) DA 6 bytes MAC address of destination node SA 6 bytes MAC address of source node Length 2 bytes Specifies the number of bytes in the LLC and data fields DSAP 1 byte Destination Service Access Point – receiving process at the destination device SSAP 1 byte Source Service Access Point – sending process in the source device Data/Pad Upper layer protocol information, if any The MAC layer may pad the field to ensure overall 64 byte minimum frame s