hi all

when i capture packets using in ethereal it shows four fields
1) source mac add
2) destination mac add
3) protocol type
4) trailer (not significant)

this structure shown confirms to the header file - /usr/include/netinet/if_ethernet.h

but when a particular packet is captured whose protocol type is NBIPX, then it does not show protocol type at ethernet layer instead it shows length field..

my problem is that how etherreal is able to extract length at ethernet layer when there is no such field in the structure defined in the header file.

There are several different Ethernet frame formats that carry slightly different header fields.

The Ethernet_2 frame format has these fields:

Preamble, Destination Address, Source Address, Type, Data and CRC.

The 802.3 frame format has these fields:

Preamble, Destination Address, Source Address, Length, Data and CRC.

To carry TCP/IP, the ethernet frame must have the type field. This is why the Ethernet_2 frame format is used almost exclusively today.
In the days when NetWare was king and most networks carried IPX/SPX, the 802.3 frame format was used. Since the protocol Ethereal detected is NBIPX, then the 802.3 frame format could be used.

Since the value for all protocol types is greater than 1500(Novell's IPX is #8137), it's very easy for Ethereal to detect that the 4th field is a length field, not a type field. The greatest legal size for an Ethenet packet is 1500.

Years ago it was an issue to be sure to select the proper frame format for your network. I can't remember the last time I had to make that choice though. Probably the last time I set up a NetWare server.