How To Utilize Your Protocol Analysis Equipment When Assessing LLC Behavior
This approach has been used extensively with our OmniPeek Network Analyzer. You can apply them to some degree to other analyzers as well.
1. Viewing the LLC layer
Set a station address filter to select the conversation between two data link addresses.
Remember, LLC operates on one single data link only. The LLC level of conversation ends at a router (since the router re-transmits a new frame on its ‘other side’; when it forwards a frame at Layer 3).
Set a protocol filter to select ONLY the LLC layer
You can now follow the flow of the Type 2 conversation
Alternatively you may set the filter to select one data link address and any other data link address to view all conversations associated with the first station.