0

I just learned about the endianess of ethernet frame.
Bits in byte are in little endian, but bytes are in big endian. e.g EtherType 0x0800

in cable: 
00010000 00000000
Decoding order:
<------- <-------
---------------->

Then Read by Wireshark it is:
00001000 00000000

If my understanding is correct, then, if preamble and SFD can be read, since they are

in cable:
10101010 10101010 ... 10101011
Decoding order:
<------- <------- ... <-------
----------------------------->

Read by WireShark it is:
01010101 01010101 ... 11010101

Please point out if I make mistake here.

Now, what I'm not sure is the range of the little endianness. Is the entire data stream in cable in little endianness, or it is only the ethernet frame header and footer part in little endianness?
If it is only the ethernet frame header and footer in little endianness, then I guess when I decode the frame, I should do this:

In cable: 
...     EtherType           IP version  IHL     ...
...     00010000 00000000   0100        0101    ...
Decoding order: 
...     <------- <-------   --->        --->    ...
...     ----------------------------------->    ...

Then I get:

  • Ethertype: 0x0800, ipv4
  • IP version: 0100, ipv4
  • IP packet header length: 0101, 5*32bits

If the entire ethernet frame in cable is in little endianness, then I should decode it like this:

In cable: 
...     EtherType           IP version  IHL     ...
...     00010000 00000000   0100        0101    ...
Decoding order: 
...     <------- <-------   <---        <---    ...
...     ----------------------------------->    ...

Then I get:

  • Ethertype: 0x0800, ipv4
  • IP version: 0010, ipv2?
  • IP packet header length: 1010, 10*32bits?

This one looks pretty weird. So I guess this one is wrong?

Which one is correct, I need a confirmation.

FBI_OPEN_UP
  • 1
  • 1
    Wireshark is not going to see the Preamble or SoF. Unless you have some special equipment, you will not see that, nor will you see the bits on the wire, and they are not really data bits on the wire, they are symbols. For example, 4B/5B encoding encodes four data bits into five bits on the wire to prevent more than two zero bits in a row that could throw off the clocking. – Ron Maupin Sep 30 '20 at 01:04
  • Yes, I understand, Usually Router does not send preamble and SFD to end devices. I'm just assuming. – FBI_OPEN_UP Sep 30 '20 at 01:56
  • @FBI_OPEN_UP *Every* Ethernet device needs to send a preamble & SFD on the wire. Since these aren't actually stored by a NIC you can't see them in captured packets. – Zac67 Sep 30 '20 at 10:14

0 Answers0