This chapter provides a brief discussion on what to look for in Ethernet and LAN switching when you troubleshoot a network with Wireshark

1. NDI Communications - Engineering & Training
Network analysis Using Wireshark
Lesson 8 – Ethernet and LAN Switching

2. Page 2
Lesson Objectives
By the end of this lesson, the participant will be able to:
Understand Ethernet frame structure
Use Wireshark for resolving Ethernet problems

3. Page 3
Chapter Content
Ethernet frame structure
What to look for

4. Page 4
The Ethernet Frame
Destination
MAC
Source
MAC
Protocol
Type
802.1q Data FCS
6 bytes 6 bytes 2 bytes 2 bytes 46–1,500 bytes 4 bytes
Priority CFI VLAN ID
Tag protocol
identifier
Tag control field
Proprietary
2-byte number
16 bits 3 bits 1 bit 12 bits
Protocol
Type
2 bytes
802.1Q
Tag
Tag ID: 8100 for 802.1Q
8a88 for 802.1ad
Priority: 8 levels, 0-7
CFI: Always set to “0”
VLAN ID: 0 – No VLAN
1 – Native VLAN
2-4096 Std. VLANs

5. Page 5
Ethernet Frame Example
Broadcast source
is 172.30.121.1
Service initiating the
broadcasts is SMB
Mailslot Protocol
Broadcast
destination is
broadcast

6. Page 6
Chapter Content
Ethernet frame structure
What to look for

7. Page 7
Broadcasts
5000 Packets/Second
Ethernet broadcasts filter
Packets per Second
(Packets/Tick, Tick=1Sec

8. Page 8
Summary