Chapter 9 Hardware Address &
Frame Type Identification

Hardware address of frame
 Addressing schemes
 Ethernet Frame header format
Hardware address

physical address that is unique to each node
(station, computer, network equipment)
 Each frame transmitted on network contains
a source address field and a destination
address field
 Physical address is the unique address
burned into each NIC card
Hardware addressing
schemes

Static Addressing
– universally unique physical address already assigned by
hardware manufacturer (most common)

Configurable addressing
– physical address on EPROM can be set by user

Dynamic addressing
– at boot up, computer generates and broadcasts a
potentially unused physical address. Hardware
manufacturers need not coordinate in assigning unique
range of address
Frame Headers & Frame Format

Each packet consists of a frame header
followed by frame data (fig 9.2)
 Format of the headers differ for different
network technologies (eg. Ethernet or Token
Ring).
Ethernet version 2(DIX)
frame format

Header (fig 9.3)
– Preceded by a 64-bit (8 byte) preamble containing
alternating 1 & 0’s for synchronization
– 6 byte destination address field
– 6 byte source address field
– 2 byte Ethernet frame type (eg. 0800x => IP).
Eg.

0800x
8137x
809Bx
806x
80D5x
IP version 4
IPX
Appletalk
ARP
IBM SNA
Payload
– 46-1500 bytes data
– Followed by 4 byte CRC
Unicast Frame

sender sends a packet destined for a single
network node by using the unique hardware
address of destination node
 network interface card on each machine looks at
the destination field of every packet. If the
destination address in the frame matches the
computer’s physical address, the frame is sent to
the operating system of the computer; otherwise
the frame is discarded
Broadcast Frame

sender sends a packet destined for all network
nodes by using a reserved broadcast address such
as FF:FF:FF:FF:FF:FF in Ethernet frame
 network interface card on each machine looks at
the destination field of every packet. If the
destination address in the frame is the broadcast
address or matches the computer’s physical
address, the frame is sent to the operating system
of the computer; otherwise the frame is discarded
Network Analyzer

Sniffer / protocol analyzer
 dedicated computer used to analyze
network activity by reading every packet
and delivering it to the analyzer software.
 NIC is put in promiscuous mode
 Snoop, ethereal, Etherpeek