200-201 Question 280
Single answerAn analyst is reviewing a packet capture and observes an Ethernet frame with the following characteristics: a source MAC address, a destination MAC address, a type/length field, and a data payload. Which part of the Ethernet frame is used to indicate the protocol being carried in the payload?
- A
Source MAC Address
- B
Destination MAC Address
- C
Type/Length Field
- D
Frame Check Sequence (FCS)
Show answer and explanation
Correct answer: C
Explanation
The Ethernet frame includes a Type/Length Field that specifies the protocol being encapsulated in the payload, such as IPv4, IPv6, or ARP. This field is crucial for the receiving device to correctly interpret the data. Other fields, such as Source and Destination MAC Addresses, are used for addressing, and the FCS is used for error detection.
- A. Incorrect.
The Source MAC Address is used to identify the originating device on the network and does not indicate the protocol in the payload.
- B. Incorrect.
The Destination MAC Address is used to identify the intended recipient device on the network and does not indicate the protocol in the payload.
- C. Correct.
The Type/Length Field is used to specify the protocol being carried in the data payload (e.g., IPv4, IPv6, ARP) or the length of the payload in some cases.
- D. Incorrect.
The Frame Check Sequence (FCS) is used for error detection and does not indicate the protocol in the payload.