This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Packet type, ethernet type and HLP?

0
Frame 1 (42 bytes on wire, 42 bytes captured)
Ethernet II, Src: AsustekC_b3:af:31 (00:18:f3:b3:af:31), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
Destination: Broadcast (ff:ff:ff:ff:ff:ff)
Address: Broadcast (ff:ff:ff:ff:ff:ff)
.... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast)
.... ...0 .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
Source: AsustekC_b3:af:31 (00:18:f3:b3:af:31)
Address: AsustekC_b3:af:31 (00:18:f3:b3:af:31)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast)
.... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
Type: ARP
Address Resolution Protocol (request)
Hardware type: Ethernet (0x0001)
Protocol type: IP (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: request (0x0001)
Sender MAC address: AsustekC_b3:af:31 (00:18:f3:b3:af:31)
Sender IP address: 172.26.1.25 (172.26.1.25)
Target MAC address: 00:00:00_00:00 (00:00:00:00:00:00)
Target IP address: 172.26.1.33 (172.26.1.33)

I need to know:

1. highest level protocol that is carried in this frame?
2. type of packet that this protocol message is encapsulated in?
3. the EherType value (in Hex) that identifies this protocol?

I know it's probably all right there in front of me but I'm really new at this and can't seem to decipher it.

asked 29 Jan '11, 15:02

GeekyKitty's gravatar image

GeekyKitty
1111
accept rate: 0%

edited 29 Jan '11, 16:56

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245


2 Answers:

1

Looks like a pretty normal ARP request to me, so:

  1. highest level protocol would be ARP
  2. not sure what you mean, but this ARP request is encapsulated in an ethernet frame and looking for a MAC address belonging to an IPv4 address
  3. Ethertype for is 0x0806, which usually appears in the same line like the "Type: ARP" you have quoted. At least my Wireshark quotes it right behind it, so my ARP packets have a line like this: "Type: ARP (0x0806)". No idea why yours doesn't.

Hope this helps.

answered 30 Jan '11, 05:03

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

edited 30 Jan '11, 05:04

1

Open up the Frame details in the Wireshark packet details pane. It shows you:

[Protocols in frame: eth:arp]

So, ARP is the highest level protocol, and it's encapsulated in Ethernet.

Next open up the Ethernet details. It shows you:

Type: ARP (0x0806)

So there it is: 0x0806

answered 30 Jan '11, 05:28

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%