Wireshark · Wireshark-users: Re: [Wireshark-users] Ping data size

[Satish Chandra <satishchandracms@xxxxxxxxx>]

Hi,

Are you using HP Hardware if yes then please update your interface card driver from HP website.

Sometimes the drivers are not compatible with the hardware.

Thanks Regards,
Satish

On Tue, Mar 24, 2009 at 8:30 PM, Gustavo Vera Heredia <gverah@xxxxxxxxx> wrote:

Hi all members,

I wonder if you could explain me why this happens: I ping from one computer to another one in my network. My ping data size is 2000 bytes but I see that the frames containing the ping request and reply have only 562 bytes, why not 2000??. Why is that?

This is what I can see:

Frame 13 (562 bytes on wire, 562 bytes captured)
Ethernet II, Src: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59), Dst: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
Destination: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
Source: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
Type: IP (0x0800)
Internet Protocol, Src: 10.24.4.13 (10.24.4.13), Dst: 10.24.4.16 (10.24.4.16)
Internet Control Message Protocol
Type: 8 (Echo (ping) request)
Code: 0
Checksum: 0xb577 [correct]
Identifier: 0x0200
Sequence number: 0xc400
Data (2000 bytes)
Frame (562 bytes):

Frame 14 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2), Dst: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
Destination: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
Source: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
Type: IP (0x0800)
Internet Protocol, Src: 10.24.4.16 (10.24.4.16), Dst: 10.24.4.13 (10.24.4.13)
Data (1480 bytes)

Frame 15 (562 bytes on wire, 562 bytes captured)
Ethernet II, Src: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2), Dst: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
Destination: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
Source: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
Type: IP (0x0800)
Internet Protocol, Src: 10.24.4.16 (10.24.4.16), Dst: 10.24.4.13 (10.24.4.13)
Internet Control Message Protocol
Type: 0 (Echo (ping) reply)
Code: 0
Checksum: 0xbd77 [correct]
Identifier: 0x0200
Sequence number: 0xc400
Data (2000 bytes)
Frame (562 bytes):

 

(following frames)

 

Frame 16 (60 bytes on wire, 60 bytes captured)
IEEE 802.3 Ethernet
Logical-Link Control
Spanning Tree Protocol

...

 

No.     Time        Source                Destination           Protocol Info
     17 2.759099    RealtekS_a3:41:b3     Broadcast             ARP      Who has 10.24.4.62?  Tell 10.24.4.11

Frame 17 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: RealtekS_a3:41:b3 (00:e0:4c:a3:41:b3), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
    Destination: Broadcast (ff:ff:ff:ff:ff:ff)
    Source: RealtekS_a3:41:b3 (00:e0:4c:a3:41:b3)
    Type: ARP (0x0806)
    Trailer: 839501100001000000000000204641464B46
Address Resolution Protocol (request)
    Hardware type: Ethernet (0x0001)
    Protocol type: IP (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: request (0x0001)
    Sender MAC address: RealtekS_a3:41:b3 (00:e0:4c:a3:41:b3)
    Sender IP address: 10.24.4.11 (10.24.4.11)
    Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
    Target IP address: 10.24.4.62 (10.24.4.62)

 

 

No.     Time        Source                Destination           Protocol Info
     18 2.842990    RealtekS_a4:d4:10     Broadcast             ARP      Who has 10.24.4.62?  Tell 10.24.4.14

Frame 18 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: RealtekS_a4:d4:10 (00:e0:4c:a4:d4:10), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
    Destination: Broadcast (ff:ff:ff:ff:ff:ff)
    Source: RealtekS_a4:d4:10 (00:e0:4c:a4:d4:10)
    Type: ARP (0x0806)
    Trailer: 80D201100001000000000000204646444444
Address Resolution Protocol (request)
    Hardware type: Ethernet (0x0001)
    Protocol type: IP (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: request (0x0001)
    Sender MAC address: RealtekS_a4:d4:10 (00:e0:4c:a4:d4:10)
    Sender IP address: 10.24.4.14 (10.24.4.14)
    Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
    Target IP address: 10.24.4.62 (10.24.4.62)

 

No.     Time        Source                Destination           Protocol Info
     19 2.931289    RealtekS_a5:9e:5d     Broadcast             ARP      Who has 10.24.4.62?  Tell 10.24.4.17

Frame 19 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: RealtekS_a5:9e:5d (00:e0:4c:a5:9e:5d), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
    Destination: Broadcast (ff:ff:ff:ff:ff:ff)
    Source: RealtekS_a5:9e:5d (00:e0:4c:a5:9e:5d)
    Type: ARP (0x0806)
    Trailer: 81A701100001000000000000204646444444
Address Resolution Protocol (request)
    Hardware type: Ethernet (0x0001)
    Protocol type: IP (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: request (0x0001)
    Sender MAC address: RealtekS_a5:9e:5d (00:e0:4c:a5:9e:5d)
    Sender IP address: 10.24.4.17 (10.24.4.17)
    Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
    Target IP address: 10.24.4.62 (10.24.4.62)

 

 

No.     Time        Source                Destination           Protocol Info
     20 3.045996    RealtekS_a4:d2:ff     Broadcast             ARP      Who has 10.24.4.62?  Tell 10.24.4.10

Frame 20 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: RealtekS_a4:d2:ff (00:e0:4c:a4:d2:ff), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
    Destination: Broadcast (ff:ff:ff:ff:ff:ff)
    Source: RealtekS_a4:d2:ff (00:e0:4c:a4:d2:ff)
    Type: ARP (0x0806)
    Trailer: 3C016A105018FAB47DF8000085000000FF53
Address Resolution Protocol (request)
    Hardware type: Ethernet (0x0001)
    Protocol type: IP (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: request (0x0001)
    Sender MAC address: RealtekS_a4:d2:ff (00:e0:4c:a4:d2:ff)
    Sender IP address: 10.24.4.10 (10.24.4.10)
    Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
    Target IP address: 10.24.4.62 (10.24.4.62)

..

 

No.     Time        Source                Destination           Protocol Info
     21 3.100425    10.24.4.13            10.24.4.16            IP       Fragmented IP protocol (proto=ICMP 0x01, off=0) [Reassembled in #22]

Frame 21 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59), Dst: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
    Destination: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
    Source: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
    Type: IP (0x0800)
Internet Protocol, Src: 10.24.4.13 (10.24.4.13), Dst: 10.24.4.16 (10.24.4.16)
Data (1480 bytes)

 

No.     Time        Source                Destination           Protocol Info
     22 3.100451    10.24.4.13            10.24.4.16            ICMP     Echo (ping) request

Frame 22 (562 bytes on wire, 562 bytes captured)
Ethernet II, Src: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59), Dst: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
    Destination: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
    Source: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
    Type: IP (0x0800)
Internet Protocol, Src: 10.24.4.13 (10.24.4.13), Dst: 10.24.4.16 (10.24.4.16)
Internet Control Message Protocol
    Type: 8 (Echo (ping) request)
    Code: 0
    Checksum: 0xb477 [correct]
    Identifier: 0x0200
    Sequence number: 0xc500
    Data (2000 bytes)

Frame (562 bytes):

...

No.     Time        Source                Destination           Protocol Info
  23 3.101207    10.24.4.16            10.24.4.13            IP       Fragmented IP protocol (proto=ICMP 0x01, off=0) [Reassembled in #24]

Frame 23 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2), Dst: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
    Destination: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
    Source: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
    Type: IP (0x0800)
Internet Protocol, Src: 10.24.4.16 (10.24.4.16), Dst: 10.24.4.13 (10.24.4.13)
Data (1480 bytes)

 

No.     Time        Source                Destination           Protocol Info
     24 3.101222    10.24.4.16            10.24.4.13            ICMP     Echo (ping) reply

Frame 24 (562 bytes on wire, 562 bytes captured)
Ethernet II, Src: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2), Dst: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
    Destination: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
    Source: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
    Type: IP (0x0800)
Internet Protocol, Src: 10.24.4.16 (10.24.4.16), Dst: 10.24.4.13 (10.24.4.13)
Internet Control Message Protocol
    Type: 0 (Echo (ping) reply)
    Code: 0
    Checksum: 0xbc77 [correct]
    Identifier: 0x0200
    Sequence number: 0xc500
    Data (2000 bytes)

Frame (562 bytes):

...
No.     Time        Source                Destination           Protocol Info
     25 3.760546    RealtekS_a3:41:b3     Broadcast             ARP      Who has 10.24.4.62?  Tell 10.24.4.11

Frame 25 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: RealtekS_a3:41:b3 (00:e0:4c:a3:41:b3), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
    Destination: Broadcast (ff:ff:ff:ff:ff:ff)
    Source: RealtekS_a3:41:b3 (00:e0:4c:a3:41:b3)
    Type: ARP (0x0806)
    Trailer: 6162636465666768696A6B6C6D6E6F707172
Address Resolution Protocol (request)
    Hardware type: Ethernet (0x0001)
    Protocol type: IP (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: request (0x0001)
    Sender MAC address: RealtekS_a3:41:b3 (00:e0:4c:a3:41:b3)
    Sender IP address: 10.24.4.11 (10.24.4.11)
    Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
    Target IP address: 10.24.4.62 (10.24.4.62)

 

No.     Time        Source                Destination           Protocol Info
     26 3.999347    RealtekS_c2:f4:69     Broadcast             ARP      Who has 10.23.3.62?  Tell 10.23.3.15

Frame 26 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: RealtekS_c2:f4:69 (00:e0:4c:c2:f4:69), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
    Destination: Broadcast (ff:ff:ff:ff:ff:ff)
    Source: RealtekS_c2:f4:69 (00:e0:4c:c2:f4:69)
    Type: ARP (0x0806)
    Trailer: 83F9AD86000000010000000020454D454245
Address Resolution Protocol (request)
    Hardware type: Ethernet (0x0001)
    Protocol type: IP (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: request (0x0001)
    Sender MAC address: RealtekS_c2:f4:69 (00:e0:4c:c2:f4:69)
    Sender IP address: 10.23.3.15 (10.23.3.15)
    Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
    Target IP address: 10.23.3.62 (10.23.3.62)

No.     Time        Source                Destination           Protocol Info
     27 4.101803    10.24.4.13            10.24.4.16            IP       Fragmented IP protocol (proto=ICMP 0x01, off=0) [Reassembled in #28]

Frame 27 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59), Dst: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
    Destination: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
    Source: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
    Type: IP (0x0800)
Internet Protocol, Src: 10.24.4.13 (10.24.4.13), Dst: 10.24.4.16 (10.24.4.16)
Data (1480 bytes)

....
No.     Time        Source                Destination           Protocol Info
     28 4.101824    10.24.4.13            10.24.4.16            ICMP     Echo (ping) request

Frame 28 (562 bytes on wire, 562 bytes captured)
Ethernet II, Src: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59), Dst: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
    Destination: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
    Source: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
    Type: IP (0x0800)
Internet Protocol, Src: 10.24.4.13 (10.24.4.13), Dst: 10.24.4.16 (10.24.4.16)
Internet Control Message Protocol
    Type: 8 (Echo (ping) request)
    Code: 0
    Checksum: 0xb377 [correct]
    Identifier: 0x0200
    Sequence number: 0xc600
    Data (2000 bytes)

Frame (562 bytes):


Thanks in advance!!!

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe

-- 
Satish Chandra