The All-New Switch Book: The Complete Guide to LAN Switching Technology, Second Edition

A.1. Decision Flow

Upon receiving a frame, use the flow chart in Figure 2 and Tables 1 and 2 to decode the protocol type.

Table A.1. Protocol IDs

VALUE	PROTOCOL
0x0800	IP
0x0806	IP-ARP
0x8035	IP-RARP (rarely used)
0x8137	IPX
0x809B	AppleTalk[]
0x80F3	AppleTalk ARP[]
0x6001, 0x6002	DEC MOP
0x6003	DECnet Routing Protocol
0x6004	DEC LAT
0x6005, 0x6006	DEC Diagnostics
0x8038	DEC Spanning Tree
0x803D	DEC Ethernet Encryption
0x803F	DEC LAN Monitor
Others	NA
[]
[]

^[] AppleTalk Phase 1 uses Type field encapsulation, with 0x809B as the Type value. AppleTalk Phase 2 uses SNAP encapsulation, with SNAP OUI = 0x08-00-07.

^[] AppleTalk ARP Phase 1 uses Type field encapsulation, with 0x80F3 as the Type value. In Phase 2, AppleTalk ARP uses SNAP encapsulation, with SNAP OUI = 0x00-00-00.

Figure A.2. Figure 2 Protocol decision tree flowchart

Table A.2. LLC SAPs

VALUE	PROTOCOL
0x06	IP[]
0x42	802.1D spanning tree
0xE0	IPX/SPX (so-called 802.2 encapsulation)
Others	NA
[]

^[] While this format is theoretically permissible, commercial IP devices do not use pure LLC encapsulation with the 0x06 SAP. Stations use either type field encapsulation (on Ethernet LANs) or RFC 1042 (SNAP, with 00-00-00 OUI) encapsulation (on non-Ethernet LANs).

NetBIOS is the only protocol considered that uses LLC Type 2 (connection-oriented LLC), so the parsing of NetBIOS is shown before the check of the LLC Control field. No known protocol uses 0xFFFF for its LLC DSAP ...