1000BASE-T1 SPY mini User Manual
4.4 Spy Mode with wrapper
The user can activate the wrapper by setting the DIP Switch 5 to the up position. With
this feature, a header is added on the Ethernet sent frame. The packet received in the
1000Base-T1 port will be logged through the corresponding Ethernet Port into an
Ethernet RAW frame. The following picture shows the structure of an Ethernet
1000Base-T1 PY mini RAW frame, in this use case:
Destination
MAC
(6 bytes)
Source
MAC
(6 bytes)
Ethernet
Type
(2 bytes)
Time
Stamp
(6 bytes)
Port
(1 byte)
Extra
(1 byte)
Length
(2 bytes)
Payload
(BR
packet)
CRC
(4
bytes)
Ethernet
frame header
Figure 4-4: 1000BASE-T1 SPY mini wrapped frame
Destination MAC address 6 FF:FF:FF:FF:FF:FF
Source MAC address 6 00:50:C2:E4:30:00 (address of this device)
Ethernet Type 2 0x2282
Time stamp 6 See the note below
Port 1 See the note below
Extra 1 0x00
Length 2 Length of the ethernet gigabit SPY mini frame
Payload x BroadR-Reach packet
CRC 4 CRC of the ethernet gigabit SPY mini frame
Table 4-1: Values of 1000BASE-T1 SPY mini frame header
Note: The data Frames are enhanced with additional information as an exact
timestamp and the bus port the data was originally sent on. Timestamps are in 0.04
μs resolution and synchronous to all connected lines.
With this feature the user can record the exact time when the first byte in the preamble
field of a frame was received on a 1000Base-T1 port of the 1000Base-T1 SPY mini. It
is also possible to see the complete frame including the preamble and the CRC in
Wireshark. Normally this information is re-moved by your network interface.