How the SAPs work
Notice the “global/local” bit -- those SAPs are globally assigned! If you are a very privileged protocol, and obtain one of these, you’d set DSAP=SSAP= your assigned SAP value
How does it work if you’re not a privileged protocol? Uh…
World class kludge -- get a SAP value assigned to mean “underprivileged protocol”. Called SNAP SAP (SubNetwork Access Protocol), and it =aa hex.
If DSAP=SSAP=aa hex, then after CTL is a protocol type field
The protocol types 5 bytes long
Convention: 0.0.0protocol type allows 2 octet Ethertypes to fit into 5 octets
Confused? You’re in good company