Wireshark mailing list archives
Re: captured length > actual length
From: Alan Tu <8libra () gmail com>
Date: Wed, 2 Feb 2011 13:57:59 +0000
Andrej, I think ethernet has a frame trailer (or frame check sequence, FCS) so that the frame has a minimum length. If memory serves, 60 seems about right. The thing is, some network drivers include the frame trailer in the data sent to a sniffer, and different network drivers do not. Alan On 2/2/11, Andrej van der Zee <andrejvanderzee () gmail com> wrote:
Hi, I am looking at a packet in Wireshark with: * data link layer length 14 bytes * total IP length of 44 bytes => TOTAL = 58 bytes But, the captured bytes show 60. I was wondering where the extra 2 bytes come from? The protocol is NBSS . Thanks, Andrej ___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org?subject=unsubscribe
___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org?subject=unsubscribe
Current thread:
- captured length > actual length Andrej van der Zee (Feb 02)
- Re: captured length > actual length Alan Tu (Feb 02)
- Re: captured length > actual length Sake Blok (Feb 02)
- Re: captured length > actual length Andrej van der Zee (Feb 02)