STATISTICS OF NETWORKS GENERAL Frame: 735/6 sec ===== 802.2 SAP ===== ==== TCP/IP PORTS ==== KB/s Frame/s AvLen Telnet: 10 1.4% all 31.85 122 266 NetBIOS: 638 86.8% loc-srv: 0 0.0% eth 31.85 122 266 0xB4: 12 1.6% echo: 0 0.0% SNAP: 8 1.1% NetBIOS: 0 0.0% SNA: 0 0.0% NetWare: 1 0.1% Null: 0 0.0% SpanTree: 3 0.4% 802.2 pkt/sec: 110 Ethernet Load 2.61% ===== PROTOCOLS ===== ==== UDP/IP PORTS ==== NetB Dg: 20 2.7% ==== IP PROTOCOLS ==== IEEE802.3 662 90.1% snmp: 0 0.0% ARP 24 3.3% NetB NS: 0 0.0% UDP: 20 2.7% Ethernet 43 5.9% ntp: 0 0.0% TCP: 22 3.0% HP Probe 5 0.7% loc-srv: 0 0.0% ICMP: 1 0.1% DEC LAT 1 0.1% who: 0 0.0% Novell 0 0.0% Other: 0 0.0%
The average number of 802.2 packets and 10MBps Ethernet load percentage are shown at the botton of the GENERAL window.
Most of the windows attempt to show the most recently seen activity. New items appear at the bottom and tend to be sorted upward when tallies become larger than the entry above. This is intended to be a summary, so it is possible for not all types to be displayed (particularly when all tally slots are full). As you can see quite a lot of information can be seen in these small summaries.
The PROTOCOL window shows the types of protocols which have been noticed. This is the ethernet Length or Type field
The IP PROTOCOLS window shows the IP protocols. Expect TCP, UDP, and ICMP here.
The TCP/IP PORTS and UDP/IP PORTS windows shows some of the TCP and UDP ports which have been noticed. Ports above a certain number are not shown. Unknown ports are shown as hexadecimal values. Labels defined inside Statnet and in /etc/services are used.
The 802.2 SAP window shows the types of 802.2 SAP frames. These carry an SAP type in the ethernet Length or Type field
The above Statnet display shows the contents of what is in the "Length/Type" and "Data" portions of an ethernet packet.
From the Ethernet Frequently Asked Questions:
02.06Q: What does an ethernet packet look like?
A. See the information below, as described in the National databook.
The ethernet packet preamble is normally generated by the chipset.
Software is responsible for the destination address, source
address, type, and data. The chips normally will append the frame
check sequence.
+------------+ | | Preamble - | 62 bits | A series of alternating 1's and 0's used by the | | ethernet receiver to acquire bit synchronization. | | This is generated by the chip. +------------+ | | Start Of Frame Delimiter - | 2 bits | Two consecutive 1 bits used to acquire byte | | alignment. This is generated by the chip. +------------+ +------------+ | | Destination Ethernet Address - | 6 bytes | Address of the intended receiver. | | The broadcast address is all 1's. +------------+ | | Source Ethernet Address - | 6 bytes | The unique ethernet address of the sending | | station. +------------+ | | Length or Type field - | 2 bytes | For IEEE 802.3 this is the number of bytes of | | data. For Ethernet I&II this is the type of | | packet. Types codes are > 1500 to allow both to | | coexist. The type code for IP packets is 0x800. +------------+ | 46 bytes | Data - | to | Short packets must be padded to 46 bytes. | 1500 bytes | +------------+ +------------+ | | Frame Check Sequence - | 4 bytes | The FCS is a 32 bit CRC calculated using | | the AUTODIN II polynomial. | | This field is normally generated by the chip. +------------+The shortest packet is: 6 + 6 + 2 + 46 = 60 bytes
02.07Q: What is the difference between an
Ethernet frame and a IEEE802.3 frame? Why are there two types? Why is there
a difference?
A: Ethernet was invented at Xerox Palo Alto Research Center and later
became an international standard. IEEE handled making it a
standard; and their specifications are slightly different from the
original Xerox ones. Hence, two different types. 802.3 uses the
802.2 LLC to distinguish among multiple clients, and has a "LENGTH"
field where Ethernet has a 2-byte "TYPE" field to distinguish among
multiple client protocols.
TCP/IP and DECnet (and others) use Ethernet_II framing, which is
that which Xerox/PARC originated.
02.08Q: What is SNAP
A: Sub-Network Access Protocol, an extention to the original 802.2
data link level format. (SNAP is described in IEEE 802-1990) The
802.2 data link format replaced the Ethernet Protocol Type concept
with two 8 bit fields; Source SAP, and Destination SAP.
Unfortunately that causes problems with migration of protocols, and
the lack of SAP space that is available. So one SAP as allocated
for this scheme which greatly expands the available protocol space.
When using the SNAP SAP the first 5 bytes of data are used as a
protocol ID. The first 3 bytes should be a value allocated to you
as a vendor id, the same as you get for Source address values. The
is called the OUI (Organizationally Unique ID) The second 2 bytes
is a protocol type.
Note that this is 802.2 and applies across all 802 LAN media types.
For translation bridging, there is a convention, if you set the OUI
to zero, you are representing a mapped Ethernet frame. So that a
bridge will translate such a frame back into Ethernet format, and
not into an 802.3 frame format.
802.2 SNAP frame:
+-------+------+------+------+-------+------+------+ | MAC | DSAP | SSAP | UI | OUI | Type | data | | Header| 0xAA | 0xAA | 0x03 | 3bytes|2bytes| | +-------+------+------+------+-------+------+------+This will appear the same on all 802 compliant LAN media. On
02.09Q: Where can I find out which Protocols use which Ethernet type
numbers?
A: Look at IETF RFC-1700 - Assigned Numbers RFC.