ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: Re: [Ethereal-dev] Not understanding something in LLC

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Eduardo Escudero Sánchez" <edu.kungfu@xxxxxxxxx>
Date: Mon, 26 Jun 2006 18:09:10 +0200
>No.

>If the low-order bit of the *first* byte is 0, it's an I frame.

>Otherwise, if the bit above that is 0, it's an S frame.

>Otherwise, it's a U frame.
 
But i dont understand. If you go to teh standard 802.2-1998 to the 5.4.2.1 for example (Format of the I - PDU) you can see in the drawing that the bits are numbered from 1 to 16 and teh only indication it gives you is that the bit numbered with 1 is the least significant byte so one can deduce from here that the most significant bit of teh conrol field is teh bit numbered with 16 so the first byte of the control field will be the byte whose eight bits are the last eigth bits of the drawing. So you can not go to the last bit of the first byte to see the type of frame because you will be seeing the value of the P/F bit, dont you?
By the way Thanks for your attention

 
2006/6/25, Guy Harris <guy@xxxxxxxxxxxx>:
Eduardo Escudero Sánchez wrote:

> I have been using etehreal and i have received LLC frames.One of them
> was a TEST frame (its control field was 0xf3) But ethereal says that
> TEST comes with SNAP!!!!! isn't that impossible?.

So it was a test frame with SSAP=DSAP=0xAA?

> Only when you receive
> frames which have SSAP=DSAP=0xAA and the control byte = 0x03 (UI Frame
> then ) you can have a SNAP field of 5 bytes (3 for organization code and
> 2 for protocol identification).
> I'm wrong maybe? someone can explain me?

At least according to IEEE Std 802-2001, section "10.3.2 SNAP PDU format":

       The LLC control field (CTL) is shown for PDU type UI, Unnumbered
Information, which is the most commonly used PDU type in this context;
however, other information-carrying LLC PDU types may also be used with
SNAP.

> The other question i have is about analizing llc frames. how can one
> knows whether the controll field of the frame is two bytes long or only
> one byte?.You can know it if you know it is an unnumbered frame (1
> control byte then) or a supervisory or information frame (2 control
> bytes in that case), but in order to discover the type of the frame you
> must see the value of the bits of the least significant byte of the
> control field

No.

If the low-order bit of the *first* byte is 0, it's an I frame.

Otherwise, if the bit above that is 0, it's an S frame.

Otherwise, it's a U frame.
_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev

_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev