Know how to interpret the data contained in your Ethernet frames by understanding the frame formatting.
While tracing LAN communications, you might need to look at the transmitted frames. To understand the data that is contained in the frame, you must know how it is formatted. The figures below show the frame format of two Ethernet standards: IEEE 802.3 and Ethernet version 2.
The Frame Check Sequence (FCS) is a part of the frame put in place to verify that the information each frame contains is not damaged during transmission. If a frame is corrupted during transmission, the FCS on the frame will not match with the recipient's calculated FCS. Any frames that do not match the calculated FCS will be discarded.
| Starting Delimiter (1 byte) | Destination Address (6 bytes) | Source Address (6 bytes) | Length (2 bytes) | LLC header and Information field (46 - 1500 bytes) | Frame Check Sequence (4 bytes) |
| Starting Delimiter (1 byte) | Destination Address (6 bytes) | Source Address (6 bytes) | Type (2 bytes) | Information field (46 - 1500 bytes) | Frame Check Sequence (4 bytes) |
Ethernet version 2 supports SNA by placing the IEEE 802.2 LLC header and data into the information field. It also puts value X'80D5' into the Type field. This shows the frame format.
| Starting Delimiter | Destination Address | Source Address | Type (80D5) | Information field (Length, Padding, LLC header, Data) | Frame Check Sequence |