Wireshark · Ethereal-users: Re: [Ethereal-users] "Type/Lenght" field in Ethernet II and Ethernet802.3 frames

[Jack Jackson <jack@xxxxxxxxxxxxxxx>]

At 03:11 PM 5/28/2004, Ronnie Sahlberg wrote:

> Sent: Friday, May 28, 2004 8:44 PM
> Subject: [Ethereal-users] "Type/Lenght" field in Ethernet II and
> Ethernet802.3 frames
>
>
> >
> > Dear Ethereal users,
> >
> > First of all excuse me if this might be a bit off-topic.
> >
> > I'm studying ethernet fundamentals and I know the following facts :
> >
> > 1- Ethernet II frames have a 2-byte field called "Type"
> > 2- Ethernet IEEE 802.3 frames have a 2-byte field called "Type/Lenght"
> >    2a.- If the "Type/Lenght" field contains a number higher than
> > 0x600 Hex that means type (IP, IPX, whatever) if it's lower it means
> > the lenght of the data field.
> >
> > Then here come two questions :
> >
> > A) How does the network driver/libpcap/ethereal know where the data
> > field of an Ethernet II frame ends ?
> >
> > I'm asking because there's no "lenght" field, so it has to guess it
> > somehow.
>
> The NIC knows where it ends because when the bits stop coming in on the
> wire, that is where the frame ends.

But the frame length is not interesting, since short messages may be padded 
depending on the medium.  If there is no length in the Ethernet header then 
the protocol under the header needs to have some kind of length in it.