Meet The Ethernets

• By Joe Astorino
• August 4, 2011
• 4 Comments

Introduction

Most of us take modern day Ethernet for granted.  This is probably because it is what many of us have always known.  This is especially true if you are like me and got into this crazy business sometime in the mid 1990’s.  Today, Ethernet is a globally recognized and widely used standard.  It is used in networks all over the world, and there really isn’t anything to hold a candle to it in terms of local area networks.

Things weren’t always that way.  Ethernet has evolved over the years, and things have only in the last 15 years or so settled down to what we know and love today.  One of the most notable changes in the evolution of Ethernet has been the frame format.  Today, we will look at the different Ethernet frame formats that have existed over the years.

Brief History Of Ethernet

Why do we have all these different frame types in the first place?  Well, in 1973 this guy named Bob Metcalfe invented the first experimental version of Ethernet for Xerox at Palo Alto labs.  It was based on an early packet radio network called ALOHANET.  Anyways, after that, Digital Equipment Corporation, Intel and Xerox all got together to create their “official” ethernet standard.  This became known as the DIX consortium, and they created DIX ethernet, sometimes known as ethernet II.  Well guess what?  Everybody liked ethernet, and when that happens the industry itself usually wants to standardize things.  In this case, ethernet was something everybody wanted but that only these three huge corporations could control.  Enter the IEEE standardization process.  The IEEE jumped in and decided they would standardize ethernet for the masses.  The 802.3 working group was created for this purpose, and that is why every modern day ethernet standard is 802.3something.  The IEEE being the IEEE couldn’t just rip of DIX ethernet and call it their own — no they had to change it.  This is really why we had different formats to begin with

Original DIX Ethernet (Ethernet II)

The original DIX Ethernet was based on Metcalfe’s work at Xerox.  The header looked like what we have below, and was awesome.  Simple, to the point and it worked.

Pretty simple huh?  Notice the 2 byte type field.  In that field, there would be a 2 byte value indicating what the layer 3 protocol ethernet was carrying inside of it was.  For instance, IP is type value 0x0800 while ARP is 0x0806.  That way, the receiving device would know what to pass the frame up the network stack to.

Original IEEE 802.3

Now, the IEEE came along and changed things around a bit.  Their idea of course was still mostly based on the DIX format, but they did screw with a few things.  Below we first have the same DIX frame I showed you earlier, followed by the original IEEE format for comparison.

First off, they changed the preamble.  They basically ripped off the same exact idea, but called it two different things instead of one.  Then we have the big thing…after the source address field in the DIX header we had type.  In the IEEE header, that was replaced with something called length.

In the IEEE version, they decided to hard code the length of the frame in this 2 byte field.  How in the world would the receiving end know what layer 3 protocol the ethernet frame was carrying then?  Well, they had to invent something else for that!  That is where the 802.2 LLC header comes into play.

The 802.2 header immediately follows the length field and has 3 fields of it’s own — DSAP, SSAP and ctrl.  Instead of just saying “Hey I’m carrying IP” or whatever layer 3 protocol, the IEEE decided to specify the source protocol and the destination protocol (SSAP and DSAP).  So follow me here…you had all the usual junk, then you had the length field, then after that, as part of a completely different header called LLC you had SSAP and DSAP which told you what protocol ethernet was carrying.  What a pain in the butt. I assure you, it gets worse : )

As it turns out, mucking around with a simple idea and making it more cryptic wasn’t the greatest idea for the IEEE.  You see, they figured out later that making the field that specifies what upper layer protocol ethernet is carrying (the DSAP field) only 1 byte instead of 2 was a terrible idea. With only 1 byte, that limited them to 256 values.  On top of that, they used some of those bits for other things, so that left it extremely limited.  Uh-Oh….and so we have IEEE 802.3 with SNAP extensions : )

IEEE 802.3 with SNAP

This is the part in the story where it actually becomes pretty funny to me.  IEEE screwed up with a 1 byte DSAP field.  They knew it, and everybody knew it.  Solution?  Bow out gracefully, and return peace by changing the standard back to something that makes sense? No, let’s screw things up even more with an even more cryptic frame format, ANOTHER new header and more overhead : )  IEEE needed a fix.  They didn’t have enough room in the DSAP field for the appease the industry.  They also didn’t have a freaking DSAP value for ARP which KIND OF CAUSES A PROBLEM FOR IP traffic.  What they did was create an additional header called SNAP that goes after the LLC header.  In that new SNAP header they had, suprise!!!! A TWO BYTE type field ….which is sort of what DIX said to begin with.  Here it is

So the idea was this…IF the values of DSAP and SSAP were both 0xAA that was sort of the secret code to go ahead and know there was a SNAP header after the LLC header.  In the SNAP header Type field they had 2 bytes to work with, and everything was OK.  Sigh…I feel dirty.

Making It Work

Guess what?  Some companies ran DIX ethernet, some ran IEEE.  Since the frame formats were different, how would a piece of equipment understand which one it was?  Well, the main difference was the type/length field right?  They figured that the maximum size of an ethernet frame was 1500 bytes.  So…if what came after the source address field was <= 1500 bytes that meant it MUST be talking about the length of the frame, and therefore it MUST be IEEE 802.3.  If the field after the source address was >= 1536 bytes that meant the frame was DIX Ethernet II and that the field was talking about the ethertype value.  Well what happened to 1501 – 1535?  “Undefined” : )

So basically if you figured out the frame was IEEE then you looked at the LLC header field at the DSAP value to see what the frame was carrying inside it.  If the DSAP and SSAP both happened to be 0xAA then you looked even further into the SNAP header. If you figured out the frame was DIX, it was very simple — Look at the type value to find out what you are carrying.

In the middle of all that craziness, you had Novell trying to screw things up even more.  You see, Novell was working on their very own layer 3 routed protocol at the time. That protocol was IPX.  They wanted to use this new ethernet thing to carry IPX on local area networks.  But hey…why bother following the standards, we’ll just make our very own proprietary ethernet frame format!  Novell basically ripped off the IEEE 802.3 frame, but guess what?  They modified it so that there was no concept of the LLC header…no DSAP, SSAP or SNAP garbage.  Why?  They ONLY wanted it to carry IPX, no other layer 3 protocols.  Therefore, they didn’t have a need to specify what layer 3 protocol was being carried in the ethernet frame.  If it was novell, it was IPX baby!  This became known as Novell Ethernet or RAW Ethernet.

Redemption: 1997 IEEE 802.3 Revised

After all the years, all the craziness, all the blood shed, and all the standards, the IEEE actually did something that made sense.  They made peace with the collective ethernet world and basically said “OK we get it…we were wrong. You win.”  How did they do that?  They revised the 802.3 standard to formally acknowledge both the original DIX frame and the original IEEE frame format for compatibility.  Check it out

Now the field after source address in the IEEE 802.3 header is officially called “length/type”.  Same rules apply here, they are just officially and formally recognized.  Peace at last!

The last header here is what has been widely accepted as “standard” since 1997, and thus what I grew up with! It’s always nice to appreciate history though.  You will gain a better understanding of why things work the way they do now!