Type 1 LLC is connectionless. It simply identifies the source and destination service access points. It does little more than the Version II Ethertype. There is really no ‘analysis’ to be done on the Type 1 LLC layer. In fact, if you are viewing all the layers of a protocol stack in a summary display view you might want to collapse LLC if it is all Type 1. The WildPackets OmniPeek Network Analyzer displays the Type 1 LLC header information in the following format:
In the detail display window:
Notice the Command field under the 802.2 header. An LLC Command simply means that this frame was not in response to a previous frame; that is, it was originated spontaneously by the sending station for the purposes of the sending station. A Response would be sent as a result of receiving a Command. The fact that there is no actual instruction or demand (no actual ‘command’) should not confuse you. The term is ‘Command’ to mean that the sender was not simply responding to a previous frame. This is a trivial piece of information in most cases.
The Type 1 LLC frame is an Unnumbered Information frame; ‘UI’. This means that it is a ‘do nothing’ with regard to the LLC layer. LLC will simply move the incoming data into the specified SAP without any special attention.