Ethernet Header and Trailers

[Bluebirds1984]

hi!

i was wondering if someone could help me (please!)

i need to analyse some data from some Frames in a telnet conversation between 2 computers. the data is in Hex.

ive figured out the TCP/IP fields, but im stuck on the Ethernet header and trailers!?

what are the fields?
how big is the data in each field? - then i can seperate the data into their appropriate field.

what format must i change the hex to!

Please Help!

 

[Harold III]

there are a whole truck load of analyzer softwares in the internet, they will translate hex to legible info for you

 

[Bluebirds1984]

i have the Hex code and i can convert it but i need to know what each hex code means.

for example in the TCP/IP part of the frame, there is some Hex there regarding the length of the packet, the Version, checksum source and destination address Etc, but have no idea about the fields for the Ethernet header and trailer?!

help!

 

[Harold III]

well the ehternet header should give you something like 802.3 and MAC addresses, the trailer should give you a checksum.

 

[Bluebirds1984]

all i have is 28 Letters and Numbers for the Ethernet header, but i dont know what each Hex represents.

the amount of hex in the trailer varies in each frame.

does any1 know what the fields are for the Header and trailer, or know where i can get the Names from?

 

[Harold III]

please post the 28 letters and numbers you get and I'll figure it out for you.

 

[Bluebirds1984]

one of the ethernet headers is...


00 00 0c 05 27 d1 00 00 c0 42 ef 69 08 00


one of the trailers is

05 75 6e 69 78 32

hope u can help!

 

[Harold III]

alright man... it's a Ethernet II header, arp/rarp type, with dest address 00000c0527d1, source address 0000c042ef69.

 

[Bluebirds1984]

hey thanx!
its actually makes sense!

i can clearly see the source address and the destination address, thank you!

any idea about the 08 00 at the end of the header though????

do you know anything about the Trailers at the end of the Frame??some of the frames have identical trailers, for example

55 55 55 55 55 55 is the trailer on a few of the frames and also FF FD 03 FF 44 45.

There are other trailers too.

 

[Harold III]

0800 is the protocol type, means arp/rarp, or the following packet is an IP packet.

I don't know why you get a 6-byte trailer.... should be 4 bytes....