2

I've been asked to determine whether a frame is an Ethernet or IEEE 802.3 frame. I have researched Ethernet and IEEE 802.3 and found the format of each frame, but nothing about the frame in question points to eithe rof these

This is the frame :

000f fea6 e743 000f fea6 e84c 0800 4510
0040 018d 4000 4006 2709 0a02 7f03 0a02
7f0b f257 0017 918b 996e 0000 0000 b002
ffff 2287 0000 0204 05b4 0103 0301 0101
080a 0658 dea6 0000 0000 0402 0000
  • Preamble: 000f fea6 e743 000f
  • Destination Address: fea6 e84c 0800
  • Source Address: 4510 0040 018d

  • Type: 4000 = 16384 > does it mean anything?

    • Could someone please help me identify the type of frame this is?
    • what do we they mean when they say: these frames have different constructors?
Sosy
  • 109
  • 1
  • 2
  • 12
  • The preamble appears to be missing in this frame. The data you presented appears to start from the Destination MAC address. – yoyo_fun Jan 17 '23 at 05:31

2 Answers2

0

The DIX Ethernet Type field and IEEE 802.3 Length field are in the same position. If the value is less than 0x600 (1536) then it is interpreted as a frame length. If the value is larger than 0x600 (1536) then it is interpreted as a Type value.

Pham Huy
  • 1
0

I don't know why the English wikipedia doesn't tell anything about the Ethernet data format, but the German one points out that the preamble contains of 55 55 55....

So I would interpret your data as

Dest: 00 0f fe a6 e7 43
Src:  00 0f fe a6 e8 4c
Type field: 08 00 -> IPv4

-> not VLAN tagged; basic Ethernet format.

glglgl
  • 89,107
  • 13
  • 149
  • 217
  • thanks for ur response! but does the value of the preamble always 55 55 55 ... ? or that depends on the frame content? – Sosy Nov 25 '11 at 10:56
  • when I got the WP text correct, it is alwas `55 55 55`. This fits as well to your data - the both (example) MAC addresses seem quite similiar... – glglgl Nov 25 '11 at 12:21
  • shall I always start with the Destination mac Address whenever I got a frame like this? – Sosy Nov 25 '11 at 12:22