Ethereal-users: Re: [Ethereal-users] Frame size 2774

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Andrew Hood <ajhood@xxxxxxxxx>
Date: Wed, 22 Sep 2004 20:51:40 +1000
Guy Harris wrote:

Paul Bajorek said:


How can a frame size of 2774 be captured on a 100M
full duplex Ethernet link?



Because something attempted to put such a packet on the link, and neither
the sending nor receiving hardware rejected the packet?

Or, if you're capturing on the machine sending the packet, because it
*wasn't*, in fact, captured on that link - it was "wrapped around" by the
driver, because no Ethernet interface I know of receives packets it
transmits?

The IP "total length" field in the packet has a value of 2760 bytes, so
the IP layer of the sending machine at the IP leel (205.248.160.254)
thought such a packet length was OK, for whatever reason.
100MB Ethernet and faster supports frames of over 1500 bytes. See for example http://www.cisco.com/en/US/products/hw/switches/ps700/products_configuration_example09186a008010edab.shtml 

--
There's no point in being grown up if you can't be childish sometimes.
                -- Dr. Who