Wireshark · Ethereal-dev: Re: [Ethereal-dev] Not understanding something in LLC

[Guy Harris <guy@xxxxxxxxxxxx>]

Eduardo Escudero Sánchez wrote:

> I have been using etehreal and i have received LLC frames.One of them 
> was a TEST frame (its control field was 0xf3) But ethereal says that 
> TEST comes with SNAP!!!!! isn't that impossible?.

So it was a test frame with SSAP=DSAP=0xAA?

> Only when you receive 
> frames which have SSAP=DSAP=0xAA and the control byte = 0x03 (UI Frame 
> then ) you can have a SNAP field of 5 bytes (3 for organization code and 
> 2 for protocol identification).
> I'm wrong maybe? someone can explain me?

At least according to IEEE Std 802-2001, section "10.3.2 SNAP PDU format":

	The LLC control field (CTL) is shown for PDU type UI, Unnumbered 
Information, which is the most commonly used PDU type in this context; 
however, other information-carrying LLC PDU types may also be used with 
SNAP.

> The other question i have is about analizing llc frames. how can one 
> knows whether the controll field of the frame is two bytes long or only 
> one byte?.You can know it if you know it is an unnumbered frame (1 
> control byte then) or a supervisory or information frame (2 control 
> bytes in that case), but in order to discover the type of the frame you 
> must see the value of the bits of the least significant byte of the 
> control field

No.

If the low-order bit of the *first* byte is 0, it's an I frame.

Otherwise, if the bit above that is 0, it's an S frame.

Otherwise, it's a U frame.
_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev