I have a screenshot of an ethernet packet frame from Wireshark.
I need to explain what is the meaning of these marked lines (with dots and zeros).
I searched in web, but still I don't have an answer.
Thanks!
Best Answer
Both the LG bit (sometimes also referred to as UL bit) and the IG bit are located in the most significant byte of each MAC address, where the IG bit is the least significant bit in this byte and the LG bit is the second least significant bit in this byte.
The IG bit distinguishes whether the MAC address is an individual or group (hence IG) address. In other words, an IG bit of 0 indicates that this is a unicast MAC address, an IG bit of 1 indicates a multicast or broadcast address.
The LG or UL bit on the other hand distinguishes vendor assigned and administratively assigned MAC addresses. When you administratively change the MAC address of your device to another address, then you should set this bit to one. Many drivers and cards however do not enforce this, and I do not know one application which really relies on this one.
So the vast majority of cases (except for broadcast messages) you will see both bits set to 0 (unicast and vendor assigned), as can be confirmed in your screenshot.
On most hardware/platforms, the Ethernet checksum is handled by the NIC before it's passed up to Wireshark. There's no way (or really any reason) to pass this up to higher layers because of the fact that the NIC does this in hardware, unless you've coded the hardware/driver to behave this way. Refer to the Ethernet wiki on wiki.wireshark.org for more information.
An Ethernet frame is a layer 2 PDU - as you stated, minimum 64 bytes, maximum 1518 bytes (+4 bytes with 802.1Q tag). The frame has 18 bytes overhead, so it transports a layer 3 payload of 46 to 1500 bytes.
IGMP is IP multicast, living in layer 3. Essentially, it uses a standard IP packet with a multicast destination address. For transport, IP packets are encapsulated in layer 2 frames, for example in Ethernet.
Best Answer
Both the LG bit (sometimes also referred to as UL bit) and the IG bit are located in the most significant byte of each MAC address, where the IG bit is the least significant bit in this byte and the LG bit is the second least significant bit in this byte.
The IG bit distinguishes whether the MAC address is an individual or group (hence IG) address. In other words, an IG bit of 0 indicates that this is a unicast MAC address, an IG bit of 1 indicates a multicast or broadcast address.
The LG or UL bit on the other hand distinguishes vendor assigned and administratively assigned MAC addresses. When you administratively change the MAC address of your device to another address, then you should set this bit to one. Many drivers and cards however do not enforce this, and I do not know one application which really relies on this one.
So the vast majority of cases (except for broadcast messages) you will see both bits set to 0 (unicast and vendor assigned), as can be confirmed in your screenshot.