Revision history [back]

For LLC/SNAP, is it required for the SAPs to be 0xAA or can either/both be 0xAB?

IEEE Std 802-2014 says it can be either one. According to IEEE Std 802.2-1998:

• the low-order bit of a DSAP is the Individual/Group (I/G) bit; 0xAA and 0xAB differ only in the value of that bit.
• the low-order bit of an SSAP is the Command/Response (C/R) bit; 0xAA and 0xAB differ only in the value of that bit.

The I/G bit indicates whether "the address is an individual DSAP address" (if 0) or "the address is a group DSAP address that identifies none, one or more, or all of the service access points that are serviced by the LLC entity" (if 1).

The C/R bit indicates whether "the LLC PDU is a command" (if 0) or "the LLC PDU is a response" (if 1).

Is it required for the Control field to be 0x03, or can it be a 1- or 2-byte variety?

A SNAP frame can be a UI frame, and "other information-carrying LPD PDU types may also be used with SNAP identifiers", as per IEEE Std 802-2014. I don't know what other frame types are used, or how they are interpreted; simply treating the payload the same way the payload of a UI frame wouldn't necessarily work, so, to interpret them in Wireshark, we'd probably have to have separate tables to handle them, rathe than just using the same tables we use for UI frames.