802.3帧前导码小结
我们先看一个帧结构
后面的由数据链路层封装的我们都比较容易理解甚至都可以抓取到包来看，但是前面的前导码不是那么容易看到它的真实结构。
由物理层封装的前导码和帧起始定界符是由8字节固定值组成的。
二进制的固定值如下：
10101010 10101010 10101010 10101010 10101010 10101010 10101010 10101011
十六进制表示:
AA AA AA AA AA AA AA AB
前面7字节的作用是调整时钟，和发送端保持时钟同步。
后面的一个字节表示‘1’以后的将是帧的起始位置，将要读取目的地址。
本文出自 “俞子晨-IT之路” 博客
贴个我抓的一个完整的。都是ethereal抓的包，我用的是version 0.10.11，我不知道他用的是哪个版本。
我比较两个包，UDP包和IP包的长度都一样，就是他多了3个byte的padding。所以我的长度就是57，他的就是60。
Frame 1 (57 bytes on wire, 57 bytes captured)
Arrival Time: Aug 7, 2011 12:23:45.607414000
Time delta from previous packet: 0.000000000 seconds
Time since reference or first frame: 0.000000000 seconds
Frame Number: 1
Packet Length: 57 bytes
Capture Length: 57 bytes
Protocols in frame: eth:ip:udp:cpfi:data
Ethernet II, Src: 00:0c:29:0e:b2:89, Dst: 00:50:56:c0:00:08
Destination: 00:50:56:c0:00:08 (Vmware_c0:00:08)
Source: 00:0c:29:0e:b2:89 (Vmware_0e:b2:89)
Type: IP (0x0800) <---- 就是这里少了3个byte的padding
Internet Protocol, Src Addr: 192.168.18.137 (192.168.18.137), Dst Addr: 192.168.18.1 (192.168.18.1)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint: Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 43 <---- IP包的长度跟他也一样
Identification: 0x0000 (0)
Flags: 0x04 (Don't Fragment)
0... = Reserved bit: Not set
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 64
Protocol: UDP (0x11)
Header checksum: 0x94e7 (correct)
Source: 192.168.18.137 (192.168.18.137)
Destination: 192.168.18.1 (192.168.18.1)
User Datagram Protocol, Src Port: 5001 (5001), Dst Port: 5001 (5001)
Source port: 5001 (5001)
Destination port: 5001 (5001)
Length: 23 <-----UDP的长度跟他一样
Checksum: 0x28c9 (correct)
Cross Point Frame Injector
Header
Word one: 0x01000000
0000 .... .... .... .... .... .... .... = FrmType: 0x00000000
.... 0001 0000 00.. .... .... .... .... = srcTDA: 0x00000040
.... .... .... ..00 0000 0000 .... .... = dstTDA: 0x00000000
.... .... .... .... .... .... 0000 .... = SOFtype: SOFf (0x00000000)
.... .... .... .... .... .... .... 00.. = speed: 1 GBIT (0x00000000)
.... .... .... .... .... .... .... ..0. = OPMerror: False
.... .... .... .... .... .... .... ...0 = fromLCM: False
Word two: 0x01020607
Data (7 bytes)[/img]..
社区：
