Examining A Protocol Analysis Trace Of Transmissions And Acknowledgements In Type II Logical Link Control

After the Type 2 connection has been set up, the communicators can now send data to each other.

The communications mode used in Type 2 LLC is called "SABME" (pronounced " sa-bim-ee' ") which stands for "Set Asynchronous Balanced Mode, Extended" and was discussed in detail in earlier sections: Setup Type 2 and Type 2 Commands)

While SABME allows up to 128 frames to be sent without explicit acknowledgment the communicators are normally fast enough to acknowledge before two or three frames have become outstanding. If you ever see more than 5 unacknowledged frames outstanding then go find out who is doing it and why. It might be indicative of a very slow WAN link or an overloaded host or server.

When a station sends data it indicates the number of the frame that it is now sending (NS=) as in the following protocol analyzer trace file example:

#    Destination     Source         DSAP/SSAP            Swq/Ack
12 station_B station_A LLC C D=F0 S=F0 I NR=0 NS=0
13 station_A station_B LLC R D=F0 S=F0 RR NR=1
14 station_A station_B LLC C D=F0 S=F0 I NR=1 NS=0
15 station_B station_A LLC R D=F0 S=F0 RR NR=1
16 station_B station_A LLC C D=F0 S=F0 I NR=1 NS=1
17 station_A station_B LLC R D=F0 S=F0 RR NR=2
18 station_A station_B LLC C D=F0 S=F0 I NR=2 NS=1
19 station_B station_A LLC R D=F0 S=F0 RR NR=2
20 station_A station_B LLC C D=F0 S=F0 I NR=2 NS=2
21 station_B station_A LLC R D=F0 S=F0 RR NR=3
22 station_B station_A LLC C D=F0 S=F0 I NR=3 NS=2
23 station_A station_B LLC R D=F0 S=F0 RR NR=3

Perhaps the most confusing thing about reading an LLC trace is the fact that a station_A’s sequence number and a station_B’s sequence number often remain close to one-another. You have to pay careful attention as to the source address of the stations. Remember: station_A has a sequence number which station_A expects station_B to acknowledge. station_B has a sequence number that station_B expects station_A to acknowledge. These are two separate numbers; station_A’s and station_B’s. Each sends and acknowledges in full-duplex. Acknowledgments might be piggy-backed on top of new data. (But not in frames #12 - #23 shown above; each acknowledgment is being transmitted alone). The ‘acknowledgment’ being referred to is the fact that a station sends NR= indicating that it has received all the frames up to the specified number and it is next expecting to receive the next frame in the conversation.

In the example above, the protocol column shows that each frame is "LLC", Logical Link Control. The destination service access point (DSAP) is "F0", and so is the source service access point (SSAP). The "F0" service access point is the one that is assigned to the NetBIOS protocol stack. The List Of Service Access Points will tell you some other assigned SAP values. These frames are either marked as "I" frames (Information frames), indicating that they are carrying user data; or they are "RR", (Receiver Ready), indicating that the receiving station is ready to accept more data. By the way, when a station sends an I-Frame it is also ready to accept more data; the RR frame is used to carry an Ack with no data and the sender of the Ack is indicating that it is ready. "RR" is, to some extent, simply a default way of marking an Acknowledgement frame when the Ack has no data with it.

WildPackets is now Savvius

For the latest information on our products and services please go to our new site at www.savvius.com.

We are in the process of migrating some of our legacy content to our new site, so Wildpackets.com is still available. If the content you are looking for has already been migrated we will automatically redirect you.