Ethereal-users: Re: [Ethereal-users] Ethernet frame length

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Guy Harris" <gharris@xxxxxxxxx>
Date: Wed, 3 Aug 2005 15:33:22 -0700 (PDT)
jairo.morales01@xxxxxxxxxx wrote:
> When I capture the Ethernet frame sent
> by the boar (the ARP Request) I can see that ist length is 64 bytes (the
> standard length) but when I capture the frame sent by the PC its length is
> only 42 bytes.

That's because the way frames being sent by the machine running Ethereal
(or any other capture program) are "captured" not by being read from the
network (most if not all Ethernet interfaces don't receive packets that
they send) but by being internally supplied to the mechanism being used
for capture.

That's done *before* the packet is padded out to the minimum 64-byte
length for transmission on Ethernet, so those packets aren't padded; that
padding is what Ethereal reports as the "Trailer".