Ethernet frames

When you execute the first simple example, you will receive Ethernet frames, which are displayed as hexadecimal values on the left and ASCII characters on the right. An Ethernet frame is a unit of data (PDU, protocol data unit) of the data link layer (layer 2). [source].

DPDK Ethernet frames

The Ethernet frame for DPDK consists of:

1. [6 Bytes] destination MAC address
• ARP Ethernet frames usually have 0xFFFFFFFFFFFF as destination, because they are broadcasted to everyone in the Ethernet network.
2. [6 Bytes] source MAC address
3. [2 Bytes] EtherType
• In the payload of the Ethernet frame, other protocols are encapsulated. [source] The EtherType tells, which protocol it is. [source]
• the Ether frames for DPDK always use 0x0800 which stand for IPv4
• EtherType for ARP is 0x0806.
4. Payload: IP packet (of type IPv4) [source]
1. [1 Byte]
1. [4 Bit] Version (in IPv4 always 4)
2. [4 Bit] Size of this IPv4 header measured in words (with 1 word = 4 byte, from the 32-bit area). Smallest possible value is 5, aka the header has a size of 20 bytes.
2. [1 Byte] DSCP and ECN, currently not important.
• currently set to 0
• DSCP 0 means standard service class.
• highest QoS (quality of service) is required for VoIP (Voice over Internet Protocol), since smallest jitter (variation in latency) is noticeable in voice.
• ECN 0 means: Explicit Congestion Notification is not used [source]
3. [2 Byte] length of header + payload
4. [2 Byte] Identification field
• fragments that originate from the same package are assigned the same ID
• the receiver reassembles the fragments by using the ID of this field, the source and destination address and the fragmentation offset (to know in which order it has to piece the fragments together)
5. [2 Byte] used for IP fragmentation. [source]
• Every link has a MTU (maximum transmission unit) which specifies the maximum size a PDU may have to be delivered through it in a single network layer (layer 3) transaction.
• If the network layer PDU (in this case: the IP package) is too large, it has to be cut into smaller pieces to be delivered through this link.
• These 2 Byte are used to handle this case. (e.g. a 1-bit flag of these 2 bytes says "just drop the package if it is too large")
6. [1 Byte] Time to live (TTL)
• usually a hop-count, which counts how often it changed the network segment (the link between two nodes).
• necessary in order to drop the package if a routing loop occurs, so the package is not send infinitely through the network, leading to congestion.
• if the TTL expires, the sender usually gets a notified (ICMP time exceeded message)
7. [1 Byte] the protocol encapsulated in the IP packet
• 0x06 means TCP
• 0x11 means UDP
8. [2 Byte] header checksum
• to check the header for errors
9. [4 Byte] source IPv4 address
• the private source IPv4 may be changed by network address translation (NAT)
10. [4 Byte] destination IPv4 address
• might be changed by NAT as well
11. Payload: UDP datagram
1. [2 Byte] source port
2. [2 Byte] destination port
3. [2 Byte] length of the UPD datagram (header + payload)
4. [2 Byte] checksum
• is calculated for the header and data, so it can indicate corruption in both
• relatively weak, since its only 16 bit, so many possible errors can not be noticed
• in our case it is 0, which means that it was not even computed, so the receiver also doesn't have to check it
5. Payload: The data that we want to send

Nice to know: The actual Ethernet packet on the physical layer (layer 1) starts with 7 alternating 1 and 0 bits (starting with a 1) which allows the receiver to synchronize its clock with the sender. It follows the SFD (starter frame delimiter) which is a 1 (instead of a 0, so the alternating pattern is broken) which indicates that now the Ethernet frame starts. Following the Ethernet packet comes an interpacket gap (IPG), [source] during which no information may be transmitted. This is used to allow the receiver to process the package. Ethernet stipulates a minimum IPG.

ARP Ethernet Frames

This is not directly relevant to DPDK, but nice to know, because you will also receive random ARP (Address Resolution Protocol) packets. [source] ARP is a protocol that is used if a host knows the IP address (layer 3, network layer) of another host, but needs to find out its MAC address (layer 2, data link layer), in order to send Ethernet frames (layer 2) to it. The mapping can then be stored in an ARP cache for future use.

ARP Ethernet Frames consist of:

1. [6 Bytes] destination MAC address
• usually is 0xFFFFFFFFFFFF to broadcast this message to everyone
2. [6 Bytes] source MAC address
• the host with the requested IP address replies to the source MAC. For this reason, you will not see ARP replies, because they are not addressed to you, but only to the source address.
3. [2 Bytes] EtherType
• 0x0806 for ARP
4. Payload: ARP packet
1. [2 Byte] Hardware Type HTYPE
• 0x0001 stands for Ethernet
2. [2 Byte] Protocol Type PTYPE
• 0x0800 stands for IPv4
3. [1 Byte] Hardware Length HLEN
• The length of a hardware address (e.g. the Ethernet MAC address) in bytes. For Ethernet, addresses are 6 bytes large.
4. [1 Byte] Protocol Length PLEN
• The length of the internetwork address (i.e. the IP address). IPv4 addresses are 4 byte large.
5. [2 Byte] Operation OPER
• 1 for request, 2 for reply
6. [6 Byte] sender MAC address
7. [4 Byte] sender IP address
8. [6 Byte] receiver MAC address
• In a request this is just 0x000000000000, because the MAC address is just unknown.
9. [4 Byte] receiver IP address