print

Tip of the Month

Network Analysis Tip of the Month - November 2002

Flow Control

Has someone ever tried to speak to you in a language that you have not yet learned? This is relevant to the difficulty machines across your network may have when attempting to communicate with different frame formats present. Ethernet packets may be packaged in one of four different frame formats that are analogous to 4 different languages. Servers and some other devices such as Routers and Gateways may speak all or some of the 4 frame types. Client machines will only choose one of these four frame types. When nodes attempt communication among themselves, several communication errors may become evident. Frame types may also be limited by router configuration, as routers are generally configured to forward only one or two frame types.

For example: You have purchased an inexpensive router that would generally be used for a home environment and may only speak one frame type. You plan on using it in a small satellite campus connected to your main campus via DSL or cable. In your satellite campus, some of your nodes are able to communicate to your main campus and some are not. All nodes work well on the LAN, but a problem arises when attempting to communicate via the DSL or cable routes. The router will not pass packets of a frame type that it does not understand. The least expensive and generally least time-consuming method to correct this behavior is to change the frame type used by the nodes having problems.

To check out what frame types are being utilized on your network, view the relevant packet decodes in EtherPeek. You will want to focus on the 'Ethernet Header' portion of the frame decode. Specifically look at offset 12 & 13: if these offsets have a "Type" field, they are Version 2 frame type. If they have a "Length" field at offsets 12 & 13 and are followed by DSAP=AA and SSAP=AA, they are SNAP frames. If the DSAP and SSAP have a value other than "AA," the frame is an LSAP frame. If there is a "Length" Field and it is immediately followed by a checksum of 0xFFFF, it is a Novel Raw frame type.

Check out the WildPackets Technical Compendium for details relating to Ethernet Frame types.