Wireshark · Ethereal-dev: Re: [Ethereal-dev] Ethernet II Trailer identification

[Stephen Fisher <stephentfisher@xxxxxxxxx>]

On Sun, Jun 11, 2006 at 09:03:33AM +0200, Eduardo Escudero S?nchez wrote:

> The most i can do only with the ethernet ii field is seeing if the 
> data part of the frame has a length of 46 bytes and if it is the case 
> i know there could be trailer bytes added to it. Anyone can explain me 
> this to me a little more?(Or maybe give me a reference)

You're right that the Ethernet_II frame header doesn't tell us if there 
is a trailer.  There will always be a trailer added by the NIC upon 
transmission if there is not enough data to make the frame at least 64 
bytes (including the 14 byte header + 4 byte trailer).  From a quick 
glance at the code in packet-eth.c, Ethereal determines if there may be 
a trailer present based on the size of the rest of the frame and 
displays the last number of bytes that would be the trailer if 
appropriate.  It also takes into account whether the driver reported the 
FCS along with the data or not (or even "maybe").  On my current 
machine, I only see the trailer on received frames and not transmitted 
since the NIC hasn't put the trailer on yet.

Let us know if you want more information :)


Steve

_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev