[Ethernet] 프레임 및 패킷 분석

Ethernet Frame

 

Ethernet Frame 분석

DIX 2.0 Ethernet Frame

 

1. Ethernet Frame
   1. DIX 2.0
   2. IEEE 802.3
   3. IEEE 802.3/LLC/SMAP
2. Ether-Type
   1. IP : 0x0800
   2. ARP : 0x0806, RARP : 0x8035
   3. IPX : 0x8137

 

MAC Address

• MAC Address
  • xxxx xxx0-aa-bb-cc-dd-ee : 각 NIC의 MAC Address
  • xxxx xxx1-aa-bb-cc-dd-ee : Multicast Address
  • ff-ff-ff-ff-ff-ff : Broadcast Address
  • Example
    • 00-50-fc-99-a0-5f : NIC MAC Address
    • 01-80-c2-00-00-00 : STP Protocol을 위한 BPDU

• MAC Address 구성
  
  • OUI (Organizationally Unique Identifier)
  • FRC 1700: Assigned Numbers, IEEE에 제조사별 OUI 정의
    • http://www.ietf.org/rfc/rfc1700.txt
    • http://standards.ieee.org/regauth/oui/index.shtml
  • 3COM : 00-20-af
  • RealTeck : 00-50-fc

 

PC에서 MAC주소 확인

 

Ethernet Packet Capture

• Packet Capture Program
  • Smiffer
  • e-Watch
  • Ethereal
    • http://www.ethereal.com/distribution/win32/
    • http://winpcap.polito.it/install/default.htm