WWW.FIREWALL.

CX ETHERNET II FRAME
Preamble & SOF/Synch LAYER 1 Datalink Header LAYER 2 IP Header LAYER 3 TCP OR UDP Header LAYER 4 DATA FCS

This Diagram demonstrates an Ethernet II Frame. The Datalink, IP and TCP/UDP headers are analysed here, to give a better understanding on how they all fit within a Ethernet II frame. This is the frame you would have on your local network running TCP/IP. The lengths in the diagram are in Bits, unless specified. Note that 8 Bits = 1 Byte.

LAYER 5,6,7

LAYER 2

64 to 1518 bytes long D A T A C R C

P S R O E A F M

16 48 48 16 4 32 8 6 16 16 2 8 8 8 16 32 32 16

16 16

32 16

32 16

32 6

16

16

16

32

From 46 to 1500 bytes long

Header of packet
Preamble: 7 bytes of 10101010,
providing a 5Mhz clock at the start of each packet,this allows the receiver to lock the incoming bit stream.

IP PACKET
4 VERS: IP version 32 HLEN: length of this layers packet 8 Type of Service: How the datagram should be handled 16 Total Length: Length including header and data area 16 Identification:Allows the datagram to be fragmented and assembled 2 Frag. flag: To control fragmentation 8 Fragment Offset: Contains correct
position of fragment datagram, MTU affected

TCP PACKET
16 Source Port: Specifies the port on the sending TCP module. 16 Destination Port: Specifies the port on the receiving TCP module. 32 Sequence Number: Ensure correct sequencing of data packets . Local 32 Ack Number: Next expect ed TCP octet 32 HLEN: length of this layers packet 6 Reserved 6 Code Bits: Control functions, FIN, SYN, RST, ACK, PSH, URG 16 Windows Size: Number of octets that the sender is willing to accept 16 Checksum: TCP header checksum. (everything in the tcp packet) 16 Urgent Pointer: Indicates the end of the urgent data 32 Options: Max. TCP segment

UDP PACKET
16 Source Port: An optional 16bit field that
specifies the port on the sending module when a reply is anticipated. If not, then value is 0.

16 Destination Port: 16bit field that

specifies the port on the receiving UDP module.

Start Of Frame : Marks the start

of a new frame1 byte, thus: 10101011 The sync. Field is all 1s

16 Length: 16 bit field specifies the length of

the datagram in oct ets. 8-65535max

DATALINK
48 Destination MAC address 48 Source MAC address 16 Ether Type : 0800 = IPv4
0806=ARP, 8137-8138= Novell

16 Checksum: 16bit checksum providing error ctrl.

8 TTL: Time to live Type of Service Bit 0 to 7 (8 bits)

0 1 Precedence 2 3: Delay 4: Throughput 5: Reliability 6-7: Reserved

8 Protocol: Indicates Upper layer prot. TCP=6 UDP=17 16 Header Checksum: IP header checksum.(everything in the ip packet) 32 Source IP address 32 Destination IP address Var IP Option & padding : Security,
source routing-time stamp-network testing

DATA from Layers 5, 6,7. This is the application data we need. e.g ftp file, document file, picture e.c.t

32 Bit CRC Checksum The last 4 bytes (32bits) that the adapter reads in are the Frame Check Sequence or CRC. This CRC is generated and put together by the Datalink Layer