I’m planning to do a post on BPDUs sent by Cisco switches and analyze why they are sent. To fully understand the coming post first we need to understand the different versions of Ethernet. There is more than one version? Yes, there is although mainly one is used for all communication.

Most people will know that Robert Metcalfe was one of the inventors of Ethernet. Robert was working for Xerox back then. Digital, Intel and Xerox worked together on standardizing Ethernet. This is why it is often referred to as a DIX frame. The DIX version 1 standard was published in 1980 and the version used today is version 2. This is why we refer to Ethernet II or Ethernet version 2. The DIX version is the frame type that is most often used.

IEEE was also working on standardizing Ethernet. They began working on it in February 1980 and that is why the standard is called 802 where 802.3 is the Ethernet standard. We refer to it as Ethernet even though when IEEE released their standard it was called “IEEE 802.3 Carrier Sense Multiple Access with Collision Detection (CSMA/CD)
Access Method and Physical Layer Specifications”. So here we see the term CSMA/CD for the first time.

I’m not here to give you a history lesson but instead explain the frame types and briefly discuss the fields in them. We start with the DIX frame or Ethernet II frame. This is the frame that is most commonly used today. It looks like this.

The preamble is a pattern of alternating ones and zeroes and ending with two ones. When this pattern is received it is known that anything that comes after this pattern is the actual frame.

The source and destination MAC is used for switching based on the MAC.

The EtherType field specifies that upper level protocol. Some of the most well known ones are:

0x0800 – IP
0x8100 – 802.1Q tagged frame
0x0806 – ARP
0x86DD – IPv6

After that follow the actual payload which should be between 46 – 1500 bytes in size.

In the end there is a Frame Checking Sequence (FCS) which is used to check the validity of the frame. If the CRC check fails the frame is dropped.

In total the frame will be maximum 1514 bytes or 1518 if counting the FCS.

When it comes to 802.3 Ethernet there are actually two frame formats. One is 802.3 with 802.2 LLC SAP header. It looks like this.

This was the original version from the IEEE. Many of the fields are the same. Let’s look at those that are not.

The preamble is now divided in preamble and Start Frame Delimiter (SFD) but the function is the same.

The length field is used to indicate how many bytes of data are following this field before the FCS. It can also be used to distinguish between DIX frame and 802.3 frame as for DIX the values in this field will be higher e.g. 0x806 for ARP. If this value is greater than 1536 (0x600 Hex) then it is a DIX frame and the value is an Ethertype value.

Then we have some interesting values called DSAP, SSAP and Control. SAP stands for Service Access Point, the S and D in SSAP and DSAP stands for source and destination.

They have a similar function as the Ethertype. The SAP is used to distinguish between different data exchanges on the same station. The SSAP indicates from which service the LLC data unit was sent and the DSAP indicates the service to which the LLC data unit is being sent. IP has a SAP of 6 and 802.1D (STP) has a SAP of 42. It would be very strange to have a different SSAP and DSAP so these values should be the same. IP to IP would be SSAP of 06 and DSAP of 06. One bit (LSB) in the DSAP is used to indicate if it is a group address or an individual address. If it is set to zero it refers to an individual address going to a Local SAP (LSAP). One bit in the SSAP (LSB) indicates if it is a command or response packet. That leaves us with 128 possible different SAPs for SSAP and DSAP.

The contol field is used to select if communication should be connection-less or connection-oriented. Usually error recovery and flow control are performed by higher level services such as TCP.

The IEEE had problems to address all the layer 3 processes due to the short DSAP and SSAP fields in the header. This is why they introduced a new frame format called Subnetwork Access Protocol (SNAP). Basically this header is using the type field found in the DIX header. If the SSAP and DSAP is set to 0xAA and the Control field is set to 0x03 then SNAP encapsulation will follow. SNAP has a five byte extension to the standard 802.2 LLC header and it consists of a 3 byte OUI and a two byte Type field.

From a vendor perspective this is good because then they can have an OUI and then create their own types to use. If we look at PVST+ BPDUs from a Cisco device we will see that they are SNAP encapsulated where the organization code is Cisco (0x00000c) and the PID is PVSTP+ (0x010b). CDP is also using SNAP and it has a PID of CDP (0x0200). I will talk more about BPDUs and STP in a following post but first I wanted to provide the background on the Ethernet frame types used.

In summary there are three different Ethernet frame types used. DIX frame, also called Ethernet II, IEEE 802.3 with LLC and IEEE 802.3 with SNAP encapsulation. There are others out there as well but these are the three major ones and the DIX one is by far the most common one.

The history of Ethernet – DIX vs 802.3
Tagged on:                         

21 thoughts on “The history of Ethernet – DIX vs 802.3

  • June 7, 2012 at 12:50 am

    Nice write-up! Very well writen and informative. I have not dug into frames to this level in a good while. Give me flashbacks to my old CCNA days 🙂

    Looking forward to the next one!

  • June 7, 2012 at 7:39 am

    Great post reaper81. I can see you spent some time on this..great recap!

    Waiting for the STP one!


    • June 7, 2012 at 8:00 am


      Even though the web contains a lot of information, it actually required gathering information from a lot of sources and then figuring out which ones are most accurate. It was a good learning experience for sure.

  • June 7, 2012 at 11:37 am

    Yea reaper81, you are right.
    You cannot find all of this information in the CCIE R&S Odom book. That is why i knew you spent some time 😉

    Are there a lot of CCIE jobs in SE ? And what is the medium Salary over there for a CCIE ?

    I am planning to move to another country after my CCIE and i was thinking maybe SE ?;)

    • June 7, 2012 at 1:56 pm

      If you have a CCIE and some experience you can pretty much choose where you want to work is my guess.

      Salaries aren’t great in Sweden but it’s difficult to factor in with living costs and that we have such things as free healthcare. Salaries would be around 60-90k USD somewhere is my guess.

  • June 29, 2012 at 4:17 pm

    Another important reason for the preamble (that I remember from my “new hore training” back when I worked at Cabletron in the 90s): it’s to syncronize the clocks in the sending and recieving interfaces. The known pattern of ones and zeros allows the receiver to make sure he agress on what a “one” is and what a “zero” is before the data starts being sent…

  • July 1, 2013 at 10:04 pm

    Nice post. I was checking constantly this weblog and I’m inspired! Very useful information particularly the last section 🙂 I care for such info a lot. I used to be looking for this certain info for a very lengthy time. Thank you and good luck.

  • June 18, 2014 at 5:00 pm

    Nice post and nice explanation. Thanks.

  • October 4, 2014 at 8:19 am

    The dsap/ssap are 8 bits, if 1 bit is used for group address etc there are 7 bits left, which means 128 possible network protocols rather than 64 as you mentioned.

    • October 4, 2014 at 8:30 am

      True! Thanks for noticing. I’ll update the post.

  • January 28, 2015 at 9:45 pm

    Very helpful. Thanks

  • Pingback: CCNA Data Center 640-911 DCICN Pt 4: Brief History of Ethernet - sysadministry

  • Pingback: CCNA Data Center 640-911 DCICN – Note 3, A brief note on history of Ethernet | italchemy

  • July 7, 2015 at 7:35 pm

    Great stuff just started my CCIE journey and was really confused about this stuff after going over it in the cert guide. You really put it in terms i can understand especially the DIX type and DSAP and SSAPnow i understand whats going on with these frames and SNAP.

  • September 27, 2015 at 12:53 am

    Just came across this post while reading about the different ethernet frames.

    Just wanted to point out that It is hard to find blogs like yours that are actually enjoyable to read!

    Keep up the good work!

  • November 24, 2015 at 12:00 am

    Awesome write up – thanks!

  • April 18, 2016 at 8:51 pm

    Very informative in simple language. Nice blog ..help to learn about Ethernet very quickly.

  • August 20, 2017 at 1:17 am

    Really good explanation.. I have a question thought, What will be the total frame size of 802.3 and SNAP if counting the FCS ?

  • March 14, 2018 at 7:41 am

    hello sir i have some qeustions.
    first is that.we study above that The EtherType field specifies that upper level protocol. such as ip but realy this is the ethernet means data link layer then why we need ip etc information in this..
    other question is if SNAP use then whats the need of SSAP and DSAP..because both have same function.

  • May 30, 2018 at 4:36 am

    A NIC implemented with ethernet2 and other NIC implemented 802.3 stack, would both send / receive traffic ?
    I believe they would work!!!



Leave a Reply

Your email address will not be published. Required fields are marked *

%d bloggers like this: