Is length of ethernet header necessarily 14?

Question

Code snippet from here:

void packet_handler(u_char *param, const struct pcap_pkthdr *header, const u_char *pkt_data)
{
    ....
    /* retireve the position of the ip header */
    ih = (ip_header *) (pkt_data +
        14); //length of ethernet header
    ....

But this image doesn't say it's necessarily 14:

_{(source: lewis at www.dcs.gla.ac.uk)}

How should I do it properly?

If you edit the question after it has been answered, the answers will look nonsensical. Please do not do it. Ask another question. Or even better, think about what you want to ask and ask the right question the first time. — Pascal Cuoq, May 09 '10 at 08:33

score 7 · Accepted Answer · answered May 09 '10 at 07:34

7

In 802.3, both the source and destination addresses are 48-bit MAC addresses. 6+6+2=14

answered May 09 '10 at 07:34

Ignacio Vazquez-Abrams

776,304
153
1,341
1,358

Can you elaborate? Shouldn't it be 7+1+6+6+2=22? – httpinterpret May 09 '10 at 07:37
1

No, because those 8 bytes occur before the frame, not as part of it. – Ignacio Vazquez-Abrams May 09 '10 at 07:39
OK.But it says 2 **or** 6,so it may be 2+2+2=6 or 6+6+2=14,right? – httpinterpret May 09 '10 at 07:41
Not for 802.3. And Ethernet is 802.3. – Ignacio Vazquez-Abrams May 09 '10 at 07:45
Does it hold for both IPv6 and IPv4? – httpinterpret May 09 '10 at 07:46
1

TCP/IP is at a higher layer than 802.3. – Ignacio Vazquez-Abrams May 09 '10 at 07:48
Can you also elaborate how is value of `const struct pcap_pkthdr *header` populated? – httpinterpret May 09 '10 at 08:03
Not a clue. But that sounds like it warrants a separate question. – Ignacio Vazquez-Abrams May 09 '10 at 08:35
Sure, here we go:) http://stackoverflow.com/questions/2797089/whats-pcap-pkthdr-there-for – httpinterpret May 09 '10 at 08:48

score 5 · Answer 2 · answered Oct 07 '12 at 07:03

Yes, it's 14 in most cases for an end-station scenario. Except the case when you have an 802.1Q frame, that would throw you off by another 4 bytes. 802.1Q is primarily used for VLAN tagging and QoS on router/router communication.

The preamble and start frame delimiter are mostly used by low level firmware to capture a frame. By the time when we (application) have access to an ethernet frame, in general we don't have the preamble nor the start frame delimiter.

From what I can recall the 2 byte length of mac address was part of Ethernet I which never really gained acceptance. And the Ethernet II/802.3 that is having 6 byte addresses is the real common ethernet that we are using nowadays.

Also want to mention that the padding is 0-46, where 46 came from the minimum 64 bytes constraint on ethernet frame for collision detect (CD) purpose. 46(pad) + 14(dmac,smac,type) + 4(CRC) = 64 bytes

score 1 · Answer 3 · answered May 09 '10 at 21:34

1

The ethernet header is fixed width however extension protocols such as 802.1q for vlan/qos are common and effectivly extend the L2 header.

answered May 09 '10 at 21:34

Einstein

4,450
1
23
20

score 0 · Answer 4 · answered May 09 '10 at 21:09

0

The Wikipedia has a good picture of the frame

WIKI

IPv4 / v6 are layer 3 protocols.

answered May 09 '10 at 21:09

dbasnett

11,334
2
25
33

Is length of ethernet header necessarily 14?

4 Answers4