I would have expected that the "Trailer" as in
Frame 316560 (60 bytes on wire, 60 bytes captured)
Arrival Time: May 26, 2005 21:15:44.694770000
Time delta from previous packet: 0.000141000 seconds
Time since reference or first frame: 43.566940000 seconds
Frame Number: 316560
Packet Length: 60 bytes
Capture Length: 60 bytes
Ethernet II, Src: xx:xx:xx:xx:xx, Dst: ff:ff:ff:ff:ff:ff
Destination: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)
Source: xx:xx:xx:xx:xx (xx:xx:xx:xx:xx)
Type: ARP (0x0806)
Trailer: 0000020100020100430500D89EBC6C30...
Address Resolution Protocol (request)
Hardware type: Ethernet (0x0001)
Protocol type: IP (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: request (0x0001)
Sender MAC address: xx:xx:xx:xx:xx (xx:xx:xx:xx:xx)
Sender IP address: X.X.X.X (X.X.X.X)
Target MAC address: 00:00:00:00:00:00 (00:00:00:00:00:00)
Target IP address: Y.Y.Y.Y (Y.Y.Y.Y)
is always the same when Sender MAC/IP address, Target IP address and
Destination (here: broadcast) is always the same or always different
(modulo 2^lenght).
But when looking at roughly 9200 frames I found only 34 different
Trailers with frequency ranging from 1 to ~5900.
Or does the same Trailer indicate that the frame was counted twice due
to L2 loop?
I'm using
tethereal -v
tethereal 0.10.6
Compiled with GLib 1.2.10, with libpcap 0.7.2, with libz 1.1.4, without
libpcre,
without UCD-SNMP or Net-SNMP, without ADNS.
NOTE: this build does not support the "matches" operator for Ethereal filter
syntax.
Running with libpcap (version unknown) on SunOS 5.9.
Best regards, Arnold
--
Arnold Nipper, AN45
