Re: 802.2 frames with DSAP 0xE0

Article View: comp.dcom.lans.misc

Article #317

Back to comp.dcom.lans.misc Previous Next

#317

From: harvey
Date: Fri, 22 Jan 1993 03:00

22 lines
1512 bytes

In article <1993Jan21.203623.7308@nobeltech.se>, ppan@nobeltech.se (Per Andersson) writes:
>
> Hi.
>
> I have started to monitor our Token-Ring traffic in addition
> to the ethernet, and in the process I have had start modifying
> tcpdump for recognising 802.2 frames. SNAP-frames seems quite
> easy, but there are some other frames on the net I can`t find
> out what they are. Most of them have a DSAP and SSAP that has
> a value of 'E0'. That is - the first two bytes in the 802.2
> frame are E0E0. I have read RFC1340, which has a list off known
> DSAPs and SSAPs, and 'E0' is not one of them. Anybody able to
> help me ?

These are IPX packets (Novell NetWare).  Check the first two bytes of the
packet data; it will always be FFFF (IPX checksumming disabled).

Novell's new ODI drivers support SNAP encapsulation for IPX.  It's not very
common though (for example, I know Cisco routers don't support it).
--
James Harvey    IUPUI/OIT Technical Support/VMS & Networks
harvey@iupui.edu  uucp:iugate!harvey  bitnet:harvey@indyvax

Technical Details

Message-ID: <1993Jan21.220032.259@indyvax.iupui.edu>

Path: arc1-ca.pugleaf.net!sparky!uunet!usc!sdd.hp.com!ux1.cso.uiuc.edu!usenet.ucs.indiana.edu!indyvax.iupui.edu!harvey

References: <1993Jan21.203623.7308@nobeltech.se>

Show Full Headers

Complete Article Headers

Path: arc1-ca.pugleaf.net!sparky!uunet!usc!sdd.hp.com!ux1.cso.uiuc.edu!usenet.ucs.indiana.edu!indyvax.iupui.edu!harvey
From: harvey@indyvax.iupui.edu
Newsgroups: comp.dcom.lans.misc
Subject: Re: 802.2 frames with DSAP 0xE0
Message-ID: <1993Jan21.220032.259@indyvax.iupui.edu>
Date: 21 Jan 93 22:00:31 -0500
References: <1993Jan21.203623.7308@nobeltech.se>
Followup-To: comp.dcom.lans.misc
Organization: Indiana University-Purdue University at Indianapolis
Lines: 22

Reply to Parent Message