Introduction to Data Communications
Previous	36i. Packet Sniffing (cont'd)	Next

The first 3 bytes of the data in the Ethernet frame Info field is the header of the Logical Link Control layer (LLC IEEE 802.2).

	1st byte:	E0	Destination Service Access Port (DSAP)

	2nd byte:	E0	Source Service Access Port (SSAP)

	3rd byte:	03	Control code

E0h indicates that it is a Novell Netware stack talking (source) to a Novell Netware stack (destination). The 03h is the LLC layer's handshaking. The size of the LLC's Data field is 34 bytes. The LLC layer is covered extensively in the following chapter.

Network Layer

The data of the LLC layer becomes the header and data of the layer above it which is the Network layer. In this case, it is an IPX PDU (Protocol Data Unit) which is indicated by the first 2 bytes being FFFFh - the IPX checksum.

			(Hex)

	1st 2 bytes:	FFFF		IPX Checksum (always FFFFh, FCS does error checking)

	Next 2 bytes:	0022		IPX PDU length allowable range 001Eh (30) to 0240h (576)

	Next byte:	00		Transport control field - hop count, allowed 00 to 0Fh (15)

	Next byte:	11		Packet Type 11h (17) is Netware Core Protocol (NCP)

	Next 4 bytes:	00000000	Destination network address, all 0s indicate local network

					Segment number in server autoexec.ncf file

	Next 6 bytes:	FFFFFFFFFFFF	Destination host address (same as dest MAC address)

	Next 2 bytes:	0452		Destination socket , Service Advertising Protocol

	Next 4 bytes:	00000000	Source network address (all 0s indicate local network)

	Next 6 bytes:	0020AF109AC0	Source host address (same as soruce MAC address)

	Next 2 bytes:	400B		Source socket (arbitrarily assigned starting at 4000h)

	Last 4 bytes:	Data

	Packet Type	Field Value 	Purpose



	NLSP		00h		Netware Link Services Protocol

	RIP		01h		Routing Information Protocol

	SAP		04h		Service Advertising Protocol

	SPX		05h		Sequenced Packet Exchange

	NCP		11h		Netware Core Protocol

	NetBIOS		14h		NetBIOS and other propagated packets

Introduction to Data Communications
Previous	Table of Contents	Next