About frame length captured by ethereal. - TCP-IP

This is a discussion on About frame length captured by ethereal. - TCP-IP ; I'm using an ethernet card and using ethereal to capture some packets while i'm surfing the net. I noticed that some packet is 60B long with trailer bytes , and i know 60B is the minimum etherII length. However, sometimes, ...

+ Reply to Thread
Results 1 to 2 of 2

Thread: About frame length captured by ethereal.

  1. About frame length captured by ethereal.

    I'm using an ethernet card and using ethereal to capture some packets
    while i'm surfing the net.

    I noticed that some packet is 60B long with trailer bytes , and i know
    60B is the minimum etherII length.

    However, sometimes, i also capture frame of 54Bytes long, how can it
    be?

    Also, whey the minimum length of 60B doesn't include the FCS?!

    Regards
    tom

  2. Re: About frame length captured by ethereal.

    lostlander wrote:

    > I'm using an ethernet card and using ethereal to capture some packets
    > while i'm surfing the net.


    Ethereal is obsolete. You should use wireshark.

    > I noticed that some packet is 60B long with trailer bytes , and i know
    > 60B is the minimum etherII length.


    It's actually 64, but what's happening is that the underlying device driver
    in the OS (or the NIC itself) is not passing the last 4 bytes to wireshark,
    so a frame length of 60 bytes is reported, but nonetheless it's 64 on the
    wire.

    > However, sometimes, i also capture frame of 54Bytes long, how can it
    > be?


    For ethernet frames shorter than 64 bytes the padding is added by the
    ethernet adapter itself when it sends the frame on the wire.

    What's happening is probably that you are sending a short frame and what the
    program captures is the frame /before/ the padding is added (which is done
    in hardware by the NIC). Nonetheless, a 64-byte frame will be sent on the
    wire, as you can see if you run wireshark on a box that receives the frame.

    > Also, whey the minimum length of 60B doesn't include the FCS?!


    See above, and read the wireshark docs.


+ Reply to Thread