Layer2 Framing questions (ethernet)

Posted on 2004-10-29
Last Modified: 2012-05-05
This is my understanding of ethernet layer 2 framing methods:

802.3 raw   =     Does not have a type field.

802.2 w/LLC=     Uses LLC to determine which protocol (ip, ipx etc) to hand to at layer3

802.2 SNAP =      Why was it made? Was it created after LLC?

Ethernet II  =      Includes a type field to identify upper layer

My questions are:

1.  When I capture SNAP frames, why am I seeing LLC fields in it?  I thought 802.2 SNAP and 802.2 LLC were different beasts? Or does SNAP expand upon LLC in some way?

2. Is it possible to have differnet frame formats, all in one broadcast domain, communicating with each other?
    Or can hosts framing with 802.3 only communicate with 802.3 hosts....... vice versa....
Question by:dissolved
    LVL 36

    Accepted Solution

    Hi dissolved,
    The 802.2 frame is formatted as follows:-

    8 bytes - preamble
    6 bytes - destination mac address
    6 bytes - source mac address
    2 bytes - length
    variable - data
    4 bytes - checksum

    In Ethernet II the 'length' filed is not used but instead this are is used for the 'Type' such as IP or ARP etc...

    Within the 'Data' area you can have either SNAP or SAP LLC frames.
    SAP has a 1 bytes source SAP, 1 byte destination SAP, 1 or 2 byte control and a variable data area.
    SNAP came about later and has additional OUI and Type fields so that it works better with TCP/IP which requires the type field. In orderr to identify a SNAP frame the destination and source SAP frames are both set to AA.
    LVL 4

    Expert Comment

    I'm smiling....this was a test question on the CCIE exam years ago.  To expand a little further, the 'AA' stands for Alien Address, because you expect a SNAP (Sub Network Address Protocol) destination (and usually source) in your data, for things like, oh, Appletalk Phase II....something just out of reach of SAP.

    grblades, I love elegant straightforward answers, and yours qualifies :)

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    6 Surprising Benefits of Threat Intelligence

    All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

    What is IRC? IRC (Internet Relay Chat) is a form of communication between multiple users. It is available freely to anyone with inernet access. IRC is a great way to communicate with others e.g. There is an IRC channel for Ubuntu Linux, which is fo…
    Introduction Many times we come across a slowness or instability between two hosts, and almost always we blame the poor networking guys, just because they're an easy target.  Sometimes we forget that other factors including disk bottlenecks, CPU …
    Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

    913 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    20 Experts available now in Live!

    Get 1:1 Help Now