RE: Libpcap :: 802.3 and Ethernet headers

["Allison, Jason (JALLISON)" <JALLISON () arinc com>]

Thanks for the replies, sorry for not getting back sooner.

This is exactly the information I wanted to know.  In addition, can anyone
point me to the documentation where these boundaries are specified?

Thanks in advance,

Jason Allison
Principal Engineer
ARINC Incorporated
Office:  (410) 266-2006
FAX:  (410) 573-3026


-----Original Message-----
From: Andrew Brown [mailto:atatat () atatdot net] 
Sent: Saturday, May 31, 2003 10:10 AM
To: Guy Harris
Cc: JALLISON () arinc com; tcpdump-workers () tcpdump org
Subject: Re: [tcpdump-workers] Libpcap :: 802.3 and Ethernet headers


> > Am looking at the headers from 802.3 and Ethernet (RFC 894).  My 
> > question is:  Off the wire how does one, libpcap for example, 
> > differenciate between 802.3 and Ethernet encapsulation?
>
> By looking at the type/length field.  If it's <= 1500, it's 802.3; if 
> it's
> > 1500, it's Ethernet.  (Actually, as I remember, according to the spec
> there's a small set of values that are neither valid for 802.3 nor for 
> Ethernet, but I don't remember what the range is.)

that'd be 05dd to 05ff.  05dc is 1500, and 0600 is xerox ns idp.  :)

-- 
|-----< "CODE WARRIOR" >-----|
codewarrior () daemon org             * "ah!  i see you have the internet
twofsonet () graffiti com (Andrew Brown)                that goes *ping*!"
werdna () squooshy com       * "information is power -- share the wealth."
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:tcpdump-workers-request () tcpdump org?body=unsubscribe