On Fri, Nov 28, 2003 at 07:47:10AM -0800, john g wrote: > question about Layer 2 info displayed in ethereal > > difference between "IEEE 802.3" and "Ethernet II" ?
"IEEE 802.3" refers to packets in which the type/length field is a length field; "Ethernet II" refers to packets in which the type/length field is a type field. > since i am capturing frames on a 10/100 ethernet the > layer 2 info should have been "IEEE 802.3", No. Whether a packet is shown as "IEEE 802.3" or "Ethernet II" doesn't depend on the type of network you're capturing on; it depends on the way the packet is encapsulated. Given that IEEE Std 802.3 describes both the original "Ethernet II" (DEC/Intel/Xerox, or "DIX", Ethernet, which I assume is called "Ethernet II" because it was the successor to the 3Mb experimental Ethernet from Xerox, which I think had 8-bit rather than 48-bit link-layer addresses) encapsulation, with no length field in the packet, and the 802.x encapsulation, with a length field (requiring an 802.2 LLC header except for various unusual encapsulations such as Novell's raw 802.3 encapsulation of IPX), perhaps "IEEE 802.3" isn't the best term for the length-field version of Ethernet packets; however, I don't know of any better names. > it is commonly understood that ethernet 10/100 is ieee > 802.3 ? is that correct ? There are IEEE 802.3 standards for 10Mb, 100Mb, 1000Mb, and 10000Mb Ethernet, so, in that sense, 10Mb and 100Mb Ethernet are IEEE 802.3. > only for some common cisco protocols like cdp packets > the layer 2 shows up as ieee 802.3 ? Cisco didn't get Ethernet type values for their protocols such as CDP; instead, they used one of their own OUIs, and their own protocol numbers, for those protocols. Therefore, on Ethernet, they're encapsulated with length-field 802.3 headers plus an 802.2 header with SNAP.
