Wireshark-users: Re: [Wireshark-users] Ethernet padding in tcpdump captures?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Andreas Sikkema <h323@xxxxxxxxxx>
Date: Tue, 5 Nov 2019 14:28:55 +0100
> Unless Linux is removing the padding before the packet gets to a PF_PACKET socket, I would expect to see padding for short Ethernet packets in captures on Linux, at least if not done on the "any" device.  For *outgoing* packets, you probably won't see the padding, but for *incoming* packets, I'd expect to see the padding on all OSes.

I was kinda hoping for masses of people screaming that they had never
seen Ethernet padding in a capture from a Linux machine.. Oh well, I
will ask the netfilter people again :-)

Thanks!

-- 
Andreas Sikkema