where does the frame loses the MAC ?

jabka · 09-03-2007, 12:21 AM

Hello,...

im tirend to understand the packets way :
how they are built how they are carried etc ...

i have read in wikipedia both anout ethernet and packet also went onto protocols.com to understand a little more ..

as i understand from wikipedia the IP packets thet is sent tru ethernet " carier " (aka Frame ) :

Quote:

Originally Posted by wikipedia

However, an IP packet is often carried as the payload inside an Ethernet frame, which has its own header and trailer

while reading about ethernet i found the the next paragraph

Quote:

Frames are the format of data packets on the wire. Note that a frame viewed on the actual physical hardware would show start bits, sometimes called the preamble, and the trailing Frame Check Sequence. These are required by all physical hardware and is seen in all four following frame types. They are not displayed by packet sniffing software because these bits are removed by the Ethernet adapter before being passed on to the network protocol stack software

also watcing the diagrem on wikipedia Ethernet_frame.svg

i can defently see the MAC addres informetion while in the ethernet description page on wikipedia it is mentioned that the softwere can't see that package so the question is where does the frame becomes transpernet on the hardwere level in the ethernet card or acturally by the OS.

Yours Truley...

acid_kewpie · 09-04-2007, 09:44 AM

ok, are you asking when is a mac address removed from an ethernet frame? well never really, in as much as the frames are created and destroyed within each lan segment. data at that level, OSI layer 2, does not get passed at all. the inner IP packet, OSI layer 3, is removed from the frame which it arrived on and then processed by the device. assuming this is a router and the IP packet is routed and sent out of another interface, the router will then create an entirely brand new ethernet frame and insert to copied IP packet into it. this new ethernet frame is then addressed from the *router*'s mac address, not the client's mac address, and addressed to the next hop, be it an end machine or yet another router. so a devices MAC address never leaves the subnet it is created on. as above, you could imagine that the addresses are changed as it passes through each router, but it's actually brand new frames, with the old bits discarded completely.

nx5000 · 09-04-2007, 09:59 AM

For some hardware, the ethernet mac adress and the crc is filled by the hardware (the PHY or MAC part of an ethernet card). That's why sometimes when you send packets going out of machine A and you sniff also on machine A, you will see "incorrect crc" because it is filled much later.
Also when you receive a packet and you are not the destination MAC, if the PHY component is not put in promiscuous mode, the card will not even put it into its hardware buffer so you will never see the packet at software level.

edit: I'm not talking of the crc in the ip packets but the low level crc.

jabka · 09-04-2007, 10:13 AM

Thank you ..