Encapsulation of the Ethernet bridge traffic

Let’s consider the trace of the encapsulated Ethernet traffic, transmitted through the bridges (Bridge Ethernet). As a first example (route 2) let’s present a detailed route of messages 7 and 8 of route 1 containing exchange of messages between the Ethernet bridges (it can be seen from the address source and message receiver).

Route 2 An example of the detailed route of Ethernet bridge traffic via Frame Relay (Sniffer Expert analyzer)

------------------------- Frame 7 --------------------------

DLC: – DLC Header –

DLC:

DLC: Frame 7 arrived at 17: 54: 38.7894; frame size is 34 bytes.

DLC: This frame is dated 2 day(s) after capture started.

DLC: Destination =DTE

DLC: Source = DCE

DLC:

FRELAY: – Frame Relay –

FRELAY:

FRELAY: Address word = 0811

FRELAY: 0000 10.. 0001.... = DLCI 33

FRELAY:......0......... = Response

FRELAY:............ 0... = No forward congestion

FRELAY:.............0.. = No backward congestion

FRELAY:..............0. = Not eligible for discard

FRELAY:

FRELAY: -- Multiprotocol over Frame Relay –

FRELAY:

FRELAY: Control, pad(s) = 0300

FRELAY: NLPID = 0x80 (SNAP)

FRELAY:

SNAP: -- SNAP Header –
SNAP:

SNAP: Vendor ID - IEEE 802.1

SNAP: Type = 0007 (802.3/Ethernet)

SNAP:

ETHER: -- Ethernet Header –

ETHER:

ETHER: Destination = Station 000000218001

ETHER: Source = Station 000000218002

ETHER: 802.3 length = 10

ETHER:

LLC: -- LLC Header –

LLC:

LLC: DSAP = AA, SSAP = AA, Command, Unnumbered frame: UI

LLC:

SNAP: -- SNAP Header –

SNAP:

SNAP: Type = 80FF (Unknown)

SNAP: [2 byte s of data]

------------------------- Frame 8 --------------------------

DLC: --DLC Header-

DLC:

DLC: Frame 8 arrived at 17: 54: 38.9854; frame size is 34 bytes.

DLC: This frame is dated 2 day(s) after capture started.

DLC: Destination = DTE

DLC: Source = DCE

DLC:

FRELAY: -- Frame Relay –

FRELAY:

FRELAY: Address word = 04E1

FRELAY: 0000 01.. 1110.... = DLC130

FRELAY:......0......... = Response

FRELAY:............ 0... = No forward congestion

FRELAY:.............0.. = No backward congestion

FRELAY:..............0. = Not eligible for discard

FRELAY:

FRELAY: -- Multiprotocol over Frame Relay --

FRELAY:

FRELAY: Control, pad(s) = 0300

FRELAY: NLPID = 0x80 (SNAP)

FRELAY:

SNAP: -- SNAP Header –

SNAP:

SNAP: Vendor ID = IEEE 802.1

SNAP: Type = 0007 (802.3/Ethernet)

SNAP:

ETHER: -- Ethernet Header --

ETHER:

ETHER: Destination = Station 000000208501

ETHER: Source = Station 000000208502

ETHER: 802.3 length = 10

ETHER:

LLC: -- LLC Header –

LLC:

LLC: DSAP = AA, SSAP = AA, Command, Unnumbered frame: UI

LLC:

SNAP: -- SNAP Header --

SNAP:

SNAP: Type = 80FF (Unknown)

SNAP: [2 byte(s) of data]

For traffic transmission we use a virtual connection with the DLCI = 33 address; for the encapsulation of traffic - the SNAP protocol with the identification of encapsulated traffic through the OUI (802.1 protocol) into the bridge traffic of Ethernet (full value of OUI = 00 80 C2 on the route is not represented). The value of PID = 00 07 indicates the transfer traffic of Ethernet IEEE 802.3 without the use of FCS (see Fig. 2.1 and 2.2).

Decoding of message of a higher level protocol (the Ethernet protocol) shows the presence of a rather small IEEE 802.3 frame in the T1.618 frame. Encapsulated 802.3 frame contains the address of the source and receiver reports (6 octets each), 2 octet field of frame length and the message itself. The report begins with a message header of control of logical link of LLC (Logical Link Control) with the length of 3 octets, containing the addresses of access points to the service source and message receiver (Source Service Access Point Address - SSAP and Destination Service Access Point Address - DSAP, 1 octet each) and control field. Then the title of SNAP and two octets of data go. SNAP protocol is involved in the process of encapsulation twice: once directly to encapsulate and identify a process of encapsulation (NLPID), the second time - to identify information inside the encapsulated message.