I somehow never thought about how the LACP protocol works. I know what he is doing, what he needs to do, and how his messages are transmitted never interested.
But some time ago, I saw a traffic dump between two routers, where LACP requests were just. I ran over it briefly and my eye caught on an unfamiliar word - Slow-Protocols.
To the surprise of information about this standard in Russian, I almost did not find. There are only references to the fact that this is part of the 802.3 standard.
And yet the interesting thing, especially since it covers not only LACP.
That's what I wanted to make a brief educational program under the cut and tell you more about what problems you can catch under certain conditions.
')
So, there is such a class of protocols that are designed to control various aspects of Ethernet, in other words, Flow Control. They are part of the 802.3 standard and are divided into two types:
- Fast They should work out instantly to prevent performance degradation and interruption in the provision of services in general. As a rule, they are implemented in hardware. Actually, a representative of this class — the PAUSE mechanism — when the device's port receives more traffic than it can handle, it sends the PAUSE Frame to the opposite node with a request to lower the sending speed.
This can happen when connecting to each other different speed interfaces - for example, FE in GE. Or when setting the speed limit on the ports of the switches. Even incidents happen , but I didn’t have to deal with such problems.
Once I came across a Pause Frame in their unusual behavior. On that day, the counters received by PAUSE Frames grew rapidly on the interfaces, the monitoring system sank in accidents, the rain did not stop for 7 days . We began to analyze: the amount of traffic on these interfaces barely exceeded a couple of percent, no drops, no errors. And, what is most surprising, at the opposite end, the device did not send these same PAUSE Frames - Pause Frame Output counters to zeros. Some fanatics, because there are no intermediate devices, even transit ones.
By deep debugging with the participation of the developers, it turned out that these were some internal iron problems - the switching chip has a small buffer and sends it to the line card Pause Frames so that it reduces activity, but all this is tricky settled inside the box and does not affect the services .
The pause mechanism is a technology for full duplex liqueurs. For Half-Duplex, there is Back Pressure . It is very strict and does not just slow down, but blocks data transfer, because it actually informs the transmitting switch that a collision is taking place and you need to stop your futile attempts. But who cares now?
- Slow - those same Slow Protocols. They have not so big appetites for the frequency of sending and delay. They are implemented in software. OAM and LACP belong to this species.
For them, a special MAC address is used: - 0180-200-0002, and EtherType 8809.
Further, a very free translation of
this document, which is in addition to the standard 802.3.
RestrictionsFirst, the following restrictions apply to this type of protocol:
1) Transmit no more than 10 frames per second
2) The maximum number of protocols with EtherType 8809 is ten. Theoretically, there may be more, but for them another type will be already indicated in the Ethernet header.
3) The frame size of the "slow" protocols is limited to 128 bytes.
* Not to say that it is done honestly - OAMPDU, for example, can easily exceed this size.The above restrictions pursue a simple goal - to reduce the amount of service traffic on the network.
As for higher level protocols, there are specially allocated multicast IP addresses (224.0.0.5 for OSPF, for example), and a separate multicast MAC address was assigned to the “slow” protocols:
01-80-C2-00-00-02 .
This MAC address belongs to the range assigned to ISO / IEC 15802-3 for protocols limited to one link. In fact, this means that frames transmitted to this address cannot be redirected beyond the limits of this particular link.

It is possible that there may be "slow" protocols that require
unicast frame forwarding - this is not prohibited. That is, the address 01-80-C2-00-00-02 - this is not a requirement - this is a wish.
The “slow” protocol can use a different MAC address, but no other protocol other than the “slow” one can use this (01-80-C2-00-00-02).
As I already noted above, the protocol type of the “Slow Protocols” group (EtherType) is
8809 . Further, subtypes are defined for specific representatives of this glorious class:
SubtypesSubtype | Purpose |
---|
0 | Unused Banned Subtype |
one | Link Aggregation Control Protocol (LACP) |
2 | Link Aggregation — Marker Protocol |
3 | Operations, Administration, and Maintenance (OAM) |
4-9 | Reserved |
ten | Organization Specific Slow Protcol (OSSP) |
11–255 | Unused Banned Subtype |
As you can see, 8 bits are allocated for a subtype. Let's talk about type 10 a little lower, but with the rest everything is clear:
1 - the usual LACP familiar to us

2 is also part of the LAG mechanism for load balancing, orderly frame acquisition and optimization of LAG link management.
3 - Ethernet OAM protocols.
How to behave when receiving a frame Slow Protocols1) Drop all frames in which the forbidden subtypes of the Slow protocols are specified
2) Skip frames that carry known Slow protocols (with known subtypes) and transfer them to the appropriate services.
3) Skip frames that carry valid, but unknown protocols and transfer them to the MAC client.
OSSPDUIn fact, two currently known protocols that use this standard are LACP and OAM, but in general there is an opportunity to create your own “slow” protocol according to your needs. This is the very
point ten -
OSSP - Organization Specific Slow Protocol .
This refers to the application 57B, which describes recommendations for the implementation of some specific protocols.
Like other protocols, their frames have their own names (LACPDU, OAMPDU, BPDU), OSSP has some generalized term for this purpose - OSSPDU.
Further, there are perfectly logical requirements for the structure of the OSSPDU frame and the rules for transmission to the network, but the standard is standard, which describes all the details.
In general, I removed it deeper.
The frame of the frame OSSPDU and its transfer to the networkThe Organization Specific Slow Protocol Data Unit consists of an integer number of octets. Bits in each octet are numbered from 0 to 7. When a sequence of octets is used to represent numerical values, the most significant octets must be transmitted first.
Frame structure:

a) Octets are transmitted from top to bottom.
b) Within an octet, bits are located from 0 to 7 from left to right and are also transmitted from left to right.
c) When a sequence of octets represents a numerical value, the most significant octets shall be transmitted first.
d) When a sequence of octets represents a MAC address, the least significant bit of the first octet carries the first bit of the MAC address. The next most significant octet bit carries the second bit of the MAC address. And so on until the 8th bit. In the same way, 9–17 bits of the MAC address are assigned from the least significant to the most significant bits of the 2nd octet. End he he, as they say.
OSSPDU must contain the following fields:
a) destination MAC address. Typically, the multicast address allocated for Slow Protocols is 01-80-C2-00-00-02.
b) the sender's MAC address. Unicast address of the sending interface (LAG, if we are talking about an aggregated channel)
c) Length / Type field contains EtherType 8809
d) Subtype field contains values ​​of 10 (0x0A)
d) Field OUI - Organizationally Unique Identifier. Some identifier for the data.
f) Actual protocol data
g) fcs. But who does he care if Ethernet itself forms it?
That's the whole story about these simple, but little written in the Russian Internet protocols.
By the way, from ignorance of the intricacies of the application, the work of the protocols are born some incidents. Here are some of them and I had to
face . After that, in fact, he became interested in this topic.
Pcap file for picking.