EFE_net

By Wolfgang Keller
Draft
Originally published 2019-12-15
Last modified 2023-11-17

Acronyms

Network engineering is full of acronyms. Here are some important ones:

Acronym	Meaning	Reference
ARP	Address Resolution Protocol	section ; also mentioned in section
BOOTP	Bootstrap Protocol	section
DCCP	Datagram Congestion Control Protocol	mentioned in section
DEI	Drop eligible indicator	section
DHCP	Dynamic Host Configuration Protocol	section
DNS	Domain Name System	section
FCS	Frame Check Sequence	section
HTTP	Hypertext Transfer Protocol	mentioned in section
HTTPS	Hypertext Transfer Protocol Secure	mentioned in section
ICMP	Internet Control Message Protocol	section ; also mentioned in section
ICMPv6	Internet Control Message Protocol version 6	section ; also mentioned in section
IFG	Interframe gap (same as “interpacket gap” (IPG))	section
IP	Internet Protocol
IPG	Interpacket gap (same as “interframe gap” (IFG))	section
IPv4	Internet Protocol version 4	section ; also mentioned in section
IPv6	Internet Protocol version 6	section ; also mentioned in section
LAN	Local Area Network
MAC	Medium Access Control	section
NDP	Neighbor Discovery Protocol	section
NIC	Network Interface Controller
OSI	Open Systems Interconnection	mentioned in section
PCP	Priority code point	section
SCTP	Stream Control Transmission Protocol	mentioned in section
SFD	Start Frame Delimiter	section
TCI	Tag control information	section
TCP	Transmission Control Protocol	section ; also mentioned in section
TLS	Transport Layer Security	section ; also mentioned in section
TPID	Tag protocol identifier	section
UDP	User Datagram Protocol	section ; also mentioned in section
VID	VLAN identifier	section
VLAN	Virtual Local Area Network	section

Layering

Overview

For the naming of the layers, we refer to RFC 1122 - Requirements for Internet Hosts -- Communication Layers [published 1989-10; visited 2019-12-16T21:33:51Z]; specifically section 1.1.3:

Link Layer
Internet Layer
Transport Layer
Application Layer

Keep in mind that this “four layer abstraction” is an idealization of the reality. You will soon see examples where this idealized abstraction breaks down. Also keep in mind that in the literature, there exists different names for the layers and models with a different number of layers (for example textbooks that are more oriented towards the so-called OSI stack). We don't want to dive into these details.

Let us list some important protocols for the layers:

Link Layer:

Ethernet

Internet Layer:

ARP
Note that ARP is a “glue protocol” between a MAC-based Link Layer and IPv4. Thus, ARP packets, of course contain no Transport Layer data, let alone Application Layer data; this is an example where the “four layer abstraction” breaks down.
IPv4
IPv6

Transport Layer:

ICMP
Note that ICMP, even though formally a transport layer protocol, is considered to be part of IPv4.
ICMPv6
Note that ICMPv6, even though formally a transport layer protocol, is considered to be part of IPv6.
TCP
UDP

Two additional transport layer protocols that have been standardized, but are only rarely used in the home customer sector, are

DCCP
SCTP

Application Layer:

HTTP
Telnet (for examples)
TLS
Note that TLS can (and typically will) encapsulate other Application Layer protocols (in the Application Data Protocol), for example HTTP data (this combination is called HTTPS), i.e. “there exists a layer ‘on top of’ the Application layer”; this is another example where the “four layer abstraction” breaks down.

The protocols

Link Layer

Ethernet

An Ethernet frame looks as follows:

		Preamble	Start Frame Delimiter (SFD)	Destination MAC address	Source MAC address	802.1Q tag (VLAN tag) (optional)	Ethertype (Ethernet II) or length (IEEE 802.3)	Payload	Frame check sequence (FCS)	Interpacket gap (IPG)/Interframe gap (IFG)
Layer	# octets	7	1	6	6	(4)	2	46/42-1500	4	12
Layer 2 Ethernet frame				← 64–1518/1522 octets →
Layer 1 Ethernet packet & IPG		← 72–1526/1530 octets →								← 12 octets →

For some important sizes:

The minimum size of a Layer 2 Ethernet frame is 64 bytes. This implies that the minimum size of the Payload field is
- 46 bytes if no VLAN tag is used,
- 42 bytes if a VLAN tag is used.
The maximum size of the Payload field is 1500 bytes. This implies that the maximum size of a Layer 2 Ethernet frame is
- 1518 bytes if no VLAN tag is used,
- 1522 bytes if a VLAN tag is used.

We only consider the fields of the Layer 2 Ethernet frame here. Note that all fields that consist of multiple bytes are in big endian byte order.

Destination MAC address: Destination MAC address (6 bytes) of the Ethernet frame
Source MAC address: Source MAC address (6 bytes) of the Ethernet frame
802.1Q tag (VLAN tag) (optional): The 802.1Q tag consists of two parts:
- Tag protocol identifier (TPID): 16 bit; set to 0x8100
- Tag control information (TCI): 16 bit; the TCI is further divided into
  - Priority code point (PCP): 3 bit
  - Drop eligible indicator (DEI): 1 bit
  - VLAN identifier (VID): 12 bit
Ethertype (Ethernet II) or length (IEEE 802.3): TODO

Important values for Ethertype are:
- 0x0800: IPv4
- 0x0806: ARP
- 0x86DD: IPv6
Recall that a value of 0x8100 introduces an 802.1Q tag, which is then followed by the Ethertype/length field.
Payload: 46/42-1500 bytes of payload data. TODO: padding
Frame check sequence (FCS): TODO

Pay attention that many packet sniffers omit the value of the FCS field.

TODO

Internet Layer

IPv4

TODO

IPv6

TODO

ARP (IPv4)

TODO

NDP (IPv6)

TODO

Transport Layer

UDP

TODO

TCP

TODO

ICMP

TODO

ICMPv6

TODO

Application Layer

BOOTP

TODO

DHCP

TODO

DNS

TODO

TLS

TODO

Some dumps

Example 1

For the coloring of the hexdump:

██: Ethernet frame
██: IPv4 header
██: ICMP header
██: ICMP payload

Under https://raw.githubusercontent.com/jwbensley/Ethernet-CRC32/bd2c6234ec78e5b9e7cc0b58795c84d4f2989184/P1.txt [visited 2020-01-03T18:22:18Z] in the repository jwbensley/Ethernet-CRC32 [visited 2020-07-09T14:00:08Z] on GitHub, you can find the following dump of an Ethernet frame:

08 00 27 27 1a d5 52 54 00 12 35 02 08 00 45 00
00 54 1e 49 40 00 40 01 04 50 0a 00 02 02 0a 00
02 0f 00 00 59 d6 0f af 00 01 fd b5 f5 5a 00 00
00 00 e1 95 03 00 00 00 00 00 10 11 12 13 14 15
16 17 18 19 1a 1b 1c 1d 1e 1f 20 21 22 23 24 25
26 27 28 29 2a 2b 2c 2d 2e 2f 30 31 32 33 34 35
36 37 e6 4c b4 86

Example 2

For the coloring of the hexdump:

██: Ethernet frame
██: IPv4 header
██: TCP header

Under checksum - Calculate the FCS number from a frame ethernet - Network Engineering Stack Exchange [visited 2020-01-03T19:50:36Z], you can find the following dump of an Ethernet frame:

08 00 20 0A 70 66 08 00 20 0A AC 96 08 00 45 00
00 28 A6 F5 00 00 1A 06 75 94 C0 5D 02 01 84 E3
3D 05 00 15 0F 87 9C CB 7E 01 27 E3 EA 01 50 12
10 00 DF 3D 00 00 20 20 20 20 20 20 5A 05 DE FA

Example 3

Under https://erg.abdn.ac.uk/users/gorry/course/inet-pages/packet-decode.html [visited 2019-12-08T18:59:04Z], one can find packet dumps of the following activities:

TCP connection set-up and clear-down
Transmission of a single UDP packet

There is also a packet dump of ICMP ECHO messages, but there is a mistake in this dump; thus, we do not consider it here.

For the coloring of the hexdumps:

██: Ethernet frame
██: IPv4 header
██: TCP header/UDP header
██: TCP payload/UDP payload

TCP connection set-up and clear-down

Endpoints for the directions:

Client → Server:

Layer	Protocol	Endpoint Type	Source Endpoint	Destination Endpoint
Link Layer	Ethernet	MAC address	08:00:20:86:35:4b	00:e0:f7:26:3f:e9
Internet Layer	IPv4	IPv4 address	139.133.217.110	139.133.233.2
Transport Layer	TCP	TCP port	36869	23 (Telnet)

Server → Client:

Layer	Protocol	Endpoint Type	Source Endpoint	Destination Endpoint
Link Layer	Ethernet	MAC address	00:e0:f7:26:3f:e9	08:00:20:86:35:4b
Internet Layer	IPv4	IPv4 address	139.133.233.2	139.133.217.110
Transport Layer	TCP	TCP port	23 (Telnet)	36869

Packet 1: TCP Connect Request

Source: https://erg.abdn.ac.uk/users/gorry/course/inet-pages/packet-decode3.html [visited 2019-12-08T22:31:58Z]

           0: 00 e0 f7 26 3f e9 08 00 20 86 35 4b 08 00 45 00
          16: 00 2c 08 b8 40 00 ff 06 99 97 8b 85 d9 6e 8b 85
          32: e9 02 90 05 00 17 72 14 f1 14 00 00 00 00 60 02
          48: 22 38 a9 2c 00 00 02 04 05 b4 ?? ?? ?? ?? ?? ??

Direction: Client → Server

Packet 2: TCP ACK

Source: https://erg.abdn.ac.uk/users/gorry/course/inet-pages/packet-decode4.html [visited 2019-12-08T22:38:43Z]

           0: 08 00 20 86 35 4b 00 e0 f7 26 3f e9 08 00 45 00
          16: 00 28 aa fd 00 00 fc 06 3a 56 8b 85 e9 02 8b 85
          32: d9 6e 00 17 90 05 94 31 10 28 72 14 f1 30 50 10
          48: 22 38 1c 65 00 00 00 00 00 10 00 00 0e 1a cb b3

Direction: Server → Client

Packet 3: TCP (Telnet) Established

Source: https://erg.abdn.ac.uk/users/gorry/course/inet-pages/packet-decode5.html [visited 2019-12-08T22:39:20Z]

           0: 00 e0 f7 26 3f e9 08 00 20 86 35 4b 08 00 45 00
          16: 00 28 08 b9 40 00 ff 06 99 9a 8b 85 d9 6e 8b 85
          32: e9 02 90 05 00 17 72 14 f1 15 94 31 10 28 50 10
          48: 22 38 1c 80 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ??

Direction: Client → Server

Packet 4: TCP (Telnet) Established

Source: https://erg.abdn.ac.uk/users/gorry/course/inet-pages/packet-decode6.html [visited 2019-12-08T22:44:06Z]

           0: 00 e0 f7 26 3f e9 08 00 20 86 35 4b 08 00 45 00
          16: 00 43 08 ba 40 00 ff 06 99 7e 8b 85 d9 6e 8b 85
          32: e9 02 90 05 00 17 72 14 f1 15 94 31 10 28 50 18
          48: 22 38 9d 0f 00 00 ff fd 03 ff fb 18 ff fb 1f ff
          64: fb 20 ff fb 21 ff fb 22 ff fb 27 ff fd 05 ff fb
          80: 23 59 88 71 bf

Direction: Client → Server

What does the “strange-looking” sequence mean that the client sends? We won't teach you the obscure details of the Telnet protocol, but we want to give a short explanation. The ff₁₆ means IAC (“Interpret as Command”); see RFC 854 - Telnet Protocol Specification [visited 2019-12-16T01:25:27Z]. The byte that follows the ff₁₆ has the following meaning:

251₁₀/fb₁₆: WILL (option code)
252₁₀/fc₁₆: WON'T (option code)
253₁₀/fd₁₆: DO (option code)
254₁₀/fe₁₆: DON'T (option code)

What do these option codes refer to? The subsequent byte tells:

3₁₀/03₁₆: SUPPRESS-GO-AHEAD ; see RFC 858 - Telnet Suppress Go Ahead Option [visited 2019-12-19T20:02:22Z].
5₁₀/05₁₆: STATUS ; see RFC 859 - Telnet Status Option [visited 2019-12-19T20:34:40Z].
24₁₀/18₁₆: TERMINAL-TYPE ; see RFC 1091 - Telnet Terminal-Type Option [visited 2019-12-19T20:02:31Z].
31₁₀/1F₁₆: NAWS ; see RFC 1073 - Telnet Window Size Option [visited 2019-12-19T20:08:56Z].
“NAWS” stands for “Negotiate About Window Size”.
32₁₀/20₁₆: TERMINAL-SPEED ; see RFC 1079 - Telnet Terminal Speed Option [visited 2019-12-19T20:04:41Z].
33₁₀/21₁₆: TOGGLE-FLOW-CONTROL; see RFC 1372 - Telnet Remote Flow Control Option [visited 2019-12-19T21:06:02Z].
34₁₀/22₁₆: LINEMODE ; see RFC 1184 - Telnet Linemode Option [visited 2019-12-19T21:09:29Z].
35₁₀/23₁₆: X-DISPLAY-LOCATION ; see RFC 1096 - Telnet X display location option [visited 2019-12-19T21:44:56Z].
36₁₀/24₁₆: ENVIRON ; see RFC 1408 - Telnet Environment Option [visited 2019-12-19T21:45:37Z].
39₁₀/27₁₆: NEW-ENVIRON ; see RFC 1572 - Telnet Environment Option [visited 2019-12-19T20:15:10Z].

For a list of all the option codes cf. Telnet Options [visited 2019-12-19T20:17:07Z].

So the payload means:

ff fd 03: IAC DO SUPPRESS-GO-AHEAD
ff fb 18: IAC WILL TERMINAL-TYPE
ff fb 1f: IAC WILL NAWS
ff fb 20: IAC WILL TERMINAL-SPEED
ff fb 21: IAC WILL TOGGLE-FLOW-CONTROL
ff fb 22: IAC WILL LINEMODE
ff fb 27: IAC WILL NEW-ENVIRON
ff fd 05: IAC DO STATUS
ff fb 23: IAC WILL X-DISPLAY-LOCATION

Packet 5: TCP (Telnet) ACK

Source: https://erg.abdn.ac.uk/users/gorry/course/inet-pages/packet-decode7.html [visited 2019-12-08T22:44:39Z]

           0: 08 00 20 86 35 4b 00 e0 f7 26 3f e9 08 00 45 00
          16: 00 28 aa fd 00 00 fc 06 3a 56 8b 85 e9 02 8b 85
          32: d9 6e 00 17 90 05 94 31 10 28 72 14 f1 30 50 10
          48: 22 38 1c 65 00 00 00 00 00 10 00 00 0e 1a cb b3

Direction: Server → Client

Packet 6: TCP Disconnect Request

Source: https://erg.abdn.ac.uk/users/gorry/course/inet-pages/packet-decode8.html [visited 2019-12-08T22:45:16Z]

           0: 00 e0 f7 26 3f e9 08 00 20 86 35 4b 08 00 45 00
          16: 00 28 08 bb 40 00 ff 06 99 98 8b 85 d9 6e 8b 85
          32: e9 02 90 05 00 17 72 14 f1 30 94 31 10 28 50 11
          48: 22 38 1c 64 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ??

Direction: Client → Server

Packet 7: TCP ACK

Source: https://erg.abdn.ac.uk/users/gorry/course/inet-pages/packet-dec9.html [visited 2019-12-08T22:22:38Z]

           0: 08 00 20 86 35 4b 00 e0 f7 26 3f e9 08 00 45 00
          16: 00 28 aa fe 00 00 fc 06 3a 55 8b 85 e9 02 8b 85
          32: d9 6e 00 17 90 05 94 31 10 28 72 14 f1 31 50 10
          48: 22 38 1c 64 00 00 00 00 00 10 00 00 1e 5c d1 75

Direction: Server → Client

Packet 8: TCP ACK + Data

Source: https://erg.abdn.ac.uk/users/gorry/course/inet-pages/packet-dec10.html [visited 2019-12-08T22:21:56Z]

           0: 08 00 20 86 35 4b 00 e0 f7 26 3f e9 08 00 45 00
          16: 00 37 aa ff 00 00 fc 06 3a 45 8b 85 e9 02 8b 85
          32: d9 6e 00 17 90 05 94 31 10 28 72 14 f1 31 50 18
          48: 22 38 c1 0c 00 00 ff fd 18 ff fd 1f ff fd 23 ff
          64: fd 27 ff fd 24 b5 61 83 28

Direction: Server → Client

For the interpretation of the payload:

ff fd 18: IAC DO TERMINAL-TYPE
ff fd 1f: IAC DO NAWS
ff fd 23: IAC DO X-DISPLAY-LOCATION
ff fd 27: IAC DO NEW-ENVIRON
ff fd 24: IAC DO ENVIRON

Packet 9: TCP Reset Connection

Source: https://erg.abdn.ac.uk/users/gorry/course/inet-pages/packet-dec11.html [visited 2019-12-08T22:21:17Z]

           0: 00 e0 f7 26 3f e9 08 00 20 86 35 4b 08 00 45 00
          16: 00 28 08 bc 40 00 ff 06 99 97 8b 85 d9 6e 8b 85
          32: e9 02 90 05 00 17 72 14 f1 31 00 00 00 00 50 04
          48: 22 38 c0 c9 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ??

Direction: Client → Server

Transmission of a single UDP packet

Packet 1: UDP Unit Data Transmission

Source: https://erg.abdn.ac.uk/users/gorry/course/inet-pages/packet-dec12.html [visited 2019-12-08T19:24:22Z]:

           0: 00 e0 f7 26 3f e9 08 00 20 86 35 4b 08 00 45 00
          16: 00 26 ab 49 40 00 ff 11 f7 00 8b 85 d9 6e 8b 85
          32: e9 02 99 d0 04 3f 00 12 72 28 68 65 6c 6c 6f 68
          48: 65 6c 6c 6f ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ??

Endpoints:

Layer	Protocol	Endpoint Type	Source Endpoint	Destination Endpoint
Link Layer	Ethernet	MAC address	08:00:20:86:35:4b	00:e0:f7:26:3f:e9
Internet Layer	IPv4	IPv4 address	139.133.217.110	139.133.233.2
Transport Layer	UDP	UDP port	39376	1087

The UDP payload 68 65 6c 6c 6f 68 65 6c 6c 6f interpreted as ASCII characters is hellohello.

EFE_net

Table of contents

Acronyms

Layering

Overview

The protocols

Link Layer

Ethernet

Internet Layer

IPv4

IPv6

ARP (IPv4)

NDP (IPv6)

Transport Layer

UDP

TCP

ICMP

ICMPv6

Application Layer

BOOTP

DHCP

DNS

TLS

Some dumps

Example 1

Example 2

Example 3

TCP connection set-up and clear-down

Packet 1: TCP Connect Request

Packet 2: TCP ACK

Packet 3: TCP (Telnet) Established

Packet 4: TCP (Telnet) Established

Packet 5: TCP (Telnet) ACK

Packet 6: TCP Disconnect Request

Packet 7: TCP ACK

Packet 8: TCP ACK + Data

Packet 9: TCP Reset Connection

Transmission of a single UDP packet

Packet 1: UDP Unit Data Transmission