Ethernet Frame Preamble Ethernet 802 3 packet Data

Ethernet Frame Preamble Ethernet 802. 3 packet Data FCS 00 01 02 03 04 05 06 07 08 09 10 11 12 13 14 15 Destination Address Source Address Ether. Type Data : : : Preamble. 8 bytes. Destination Address. 6 bytes. The address(es) are specified for a unicast, multicast (subgroup), or broadcast (an entire group). Source Address. 6 bytes. The address is for a unicast (single computer or device). Ether. Type. 16 bits. Which upper layer protocol will utilized the Ethernet frame. Data. variable, 46 -1500 bytes. FCS, Frame Check Sequence. 4 bytes. Error checking with a Cycle Redundancy Check (CRC) value

Ethernet Frame (cont) Value Ether. Types 0 x 080 0 IP. 0 x 080 6 ARP, Address Resolution Protocol. 0 x 803 5 RARP, Reverse Address Resolution Protocol. 0 x 809 B Apple. Talk. 0 x 80 F 3 Apple. Talk ARP. 0 x 813 Net. Ware IPX/SPX.

IP Header (Internet Protocol ) MAC header IP header Data : : :

IP Header (cont. ) • Version : IP版本 (v 4/v 6) • Header Length : IP header長度 • Type of Service : 傳送品質的要求 – – – Bits 0 -2 : Precedence. 0~7. 資料傳送的優先順序 Bits 3: 0=Normal Delay, 1=Low Delay Bits 4: 0=Normal Throughput, 1=High Throughput Bits 5: 0=Normal Reliability 1=High Reliability Bits 6 -7 : reserved • Total Length : 本segment的大小 • Identifier : 提供segment被fragment後的識別號碼

IP Header (cont. ) • Flags : 關於fragment的控制 – 位元 0 : 保留 – 位元 1 : 0表示可以fragment，1表示不可fragment – 位元 2 : 0表示是最後一個fragment，1表示後面還有資料 • Fragmented Offset : 表示分割後的fragment在原來 segment中的相對位置，以 8個位元組為offset的單位 • Time to Live : segment在網路中保留的時間 • Protocol : IP上一層的網路協定 • Header Checksum : IP header checksum • Source Address : Source IP address • Destination Address : Destination IP address • Options : Segment測試或除錯之用 • Padding : 使header長度以 32個位元結束

TCP Header (Transmission Control Protocol) MAC header IP header TCP header Data : : :

Three-Way Handshack

UDP Header (User Datagram Protocol) MAC header IP header UDP header Data : : :

ARP Header (Address Resolution Protocol ) MAC header ARP header Data : : : Hardware type Protocol type Hardware address Protocol address length Opcode Source hardware address : : : Source protocol address : : : Destination hardware address : : : Destination protocol address : : : Data : : :

ARP Header (Cont) Val Hardware Type 1 Ethernet. 2 Experimental Ethernet. 3 Amateur Radio AX. 25. 4 Proteon Pro. NET Token Ring. 5 Chaos. 6 IEEE 802. 7 ARCNET. 8 Hyperchannel. 9 Lanstar. 10 Autonet Short Address. 11 Local. Talk. 12 Local. Net (IBM PCNet or SYTEK Local. NET). 13 Ultra link. 14 SMDS. 15 Frame Relay. 16 ATM, Asynchronous Transmission Mode. 17 HDLC. 18 Fibre Channel. 19 ATM, Asynchronous Transmission Mode. Value Ptotocol Type 0 x 800 IP. Value OPCode References 1 Request. RFC 826 2 Reply. RFC 826, RFC 1868 3 Request Reverse. RFC 903 4 Reply Reverse. RFC 903 5 DRARP Request. RFC 1931 6 DRARP Reply. RFC 1931 7 DRARP Error. RFC 1931 8 In. ARP Request. RFC 1293 9 In. ARP Reply. RFC 1293 10 ARP NAK. RFC 1577

RARP Header (Reverse Address Resolution Protocol) MAC header RARP packet 0 0 0 1 0 2 0 3 0 4 0 5 0 6 0 7 0 8 0 9 1 0 1 1 1 2 1 3 1 4 1 5 1 6 1 7 1 8 1 9 2 0 2 1 Hardware type Hardware address length 2 2 2 3 2 4 2 5 Protocol type Protocol address length Source hardware address : : : Source protocol address : : : Destination hardware address : : : Destination protocol address : : : Opcode 2 6 2 7 2 8 2 9 3 0 3 1

ICMP (Internet Control Message Protocol) MAC header IP header ICMP header Data : : : 0 0 0 0 0 1 1 1 1 1 2 2 2 2 2 3 3 0 1 2 3 4 5 6 7 8 9 0 1 Type Data : : : Code ICMP header checksum

ICMP - Traceroute • ICMP型：Microsoft用ICMP實作traceroute – 起點發送 ICMP Echo-Request (type 8) – TTL = 1 to N，每次+1 – 沿路設備回覆 ICMP Time-Exceeded (type 11) – 終點回覆 ICMP Echo-Reply • UDP型：大部分皆為此型 – 起點發送UDP，Port 指定高段數字(>32768) – TTL = 1 to N，每次+1 – 沿路設備回覆 ICMP Time-Exceeded (type 11) – 終點回覆 ICMP Unreachable (type 3, code 3)