Ethereal-users: Re: [Ethereal-users] ARP reply before the request

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Wed, 3 Apr 2002 14:24:21 -0800
On Wed, Apr 03, 2002 at 03:13:37PM +0200, akira.nakandakare@xxxxxxxxxxxxx wrote:
> Besides that, the ARP requests that my computer produce have only 46 
> bytes and the other ARP requests have only 60 bytes, which is bellow 
> the Ethernet packet minimum length.

There is no guarantee that packets sent on an Ethernet by the machine
running a sniffer program (Ethereal, tcpdump, whatever) will necessarily
be padded to the minimum Ethernet packet length when they are seen by
the sniffer; it may be that outgoing packets are sent to the OS
mechanism used by sniffers *before* they get padded and transmitted.

If so (and I think I've seen that on Linux, for example), you may well
see Ethernet packets that are smaller than 60 bytes.

> And no packet has the Ethernet CRC.

There is no guarantee that the OS mechanism used by sniffers, or the
driver, will include the CRC on incoming packets.  The chances are good
that the CRC will not be included on outgoing packets, as the CRC is
probably added to the packet by the network interface, and not seen by
the host at all.