The canonical form of Ethernet addresses is xx-xx-xx-xx-xx-xx, where each xx is one byte. The first three bytes are the Organizationally Unique Identifier, or "OUI". These are address blocks of 2^24 which are obtained from the IEEE by a manufacturer for $1000.
One of the bits in the 24-bit OUI is the "group/individual" (multicast) bit; another is the "globally/locally assigned" bit. The first bit on the wire must be the multicast bit.
There is no way to tell, looking at the data inside the data link layer (DLL) packet alone, what protocol is belongs to (IP, IPX, Appletalk, etc.). Therefore, it would be nice to identify the network layer packet type in the DLL header. There are two different approaches to this: the "protocol type " field and the "SAP" or "socket".
Original Ethernet DLL header had such a type field. The later 802.3 header had a length field instead, in the same place. (It is always possible to tell whether this field refers to length or type because all of the types are greater than 8000, while the maximum packet size is 1492 bytes.)
It's good that 802.3 added the length field, because padding is often necessary on short messages. Original Ethernet had some kind of kludge to recover the "real" data from a padded packet.
The 802.3 packet has a dest and a src SAP, called DSAP and SSAP. Each SAP is 8 bits. Of these, one is "group/individual" (although no one knows what a group SAP is), another is "globally/locally assigned". The global/local SAP clears the way for the IEEE to assign SAPS; unfortunately, the meaning of this bit is in the opposite sense to the meaning of the global/local bit in the OUI.
After these 2 bits are taken away, 6 bits are left.
If you get an assigned protocol number, you can put it in both SSAP and DSAP. If not, you have different SSAPs and DSAPs, since both the source and dest will have assigned their own number to the protocol. so how do you multicast based on protocol? Answer: we define a SSAP, DSAP that means "look inside the data for the protocol type". This is called SNAP.
The SSAP, DSAP that means "look in the data for the protocol type" is AA hex, or 10101010.
The Ethernet protocol type field is 2 bytes. OUIs are 3 bytes; therefore the SNAP protocol type field is 5 bytes long: a 3 byte OUI followed by a 2 byte type.
The developer at Novell who worked on IPX was told to implement IPX on 802.3. He didn't know about 802.2, so he implemented IPX without a DSAP, SSAP field. He put a checksum field where DSAP belongs, which, fortunately, never got used; it is always FFFF. But, all 1's is the "broadcast SAP". This means that the DLL should hand the IPX packet to every process in your machine. This is the "raw 802.3" type.
Here, DSAP = SSAP = 0xAA and the protocol type = 0.0.0.81.37
Unable to obtain a globally assigned SAP, Novell used a locally assigned SAP of 0xE0 as the SAP value for IPX. So, DSAP = SSAP = 0xE0
A server can talk to all of these packet types; endnodes only talk to one, ignoring the others. A different IPX network number is used for each format.