ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: [Ethereal-dev] Not understanding something in LLC

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Eduardo Escudero Sánchez" <edu.kungfu@xxxxxxxxx>
Date: Sun, 25 Jun 2006 08:30:36 +0200
Hi,ihave two questions
I have been using etehreal and i have received LLC frames.One of them was a TEST frame (its control field was 0xf3) But ethereal says that TEST comes with SNAP!!!!! isn't that impossible?. Only when you receive frames which have SSAP=DSAP=0xAA and the control byte = 0x03 (UI Frame then ) you can have a SNAP field of 5 bytes (3 for organization code and 2 for protocol identification).
I'm wrong maybe? someone can explain me?
 
The other question i have is about analizing llc frames. how can one knows whether the controll field of the frame is two bytes long or only one byte?.You can know it if you know it is an unnumbered frame (1 control byte then) or a supervisory or information frame (2 control bytes in that case), but in order to discover the type of the frame you must see the value of the bits of the least significant byte of the control field but if we dont know which is the length of that field how cab we then get that least significant byte. ¿Someone can explain me? Thanks 
_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev