Wireshark · Ethereal-users: Re: [Ethereal-users] Meaning of Trailer in Ethernet frames

[Arnold Nipper <arnold@xxxxxxxxx>]

On 02.06.2005 22:39 Ulf Lamping wrote

> Arnold Nipper wrote:
>
> > I would have expected that the "Trailer" as in
> >
> > Frame 316560 (60 bytes on wire, 60 bytes captured)
> >      Type: ARP (0x0806)
> >      Trailer: 0000020100020100430500D89EBC6C30...
> >
> > is always the same when Sender MAC/IP address, Target IP address and
> > Destination (here: broadcast) is always the same or always different
> > (modulo 2^lenght).
> >
> > But when looking at roughly 9200 frames I found only 34 different
> > Trailers with frequency ranging from 1 to ~5900.
> >
> > Or does the same Trailer indicate that the frame was counted twice due
> > to L2 loop?
>
> Simply speaking, the trailer probably doesn't tell you anything.
>
> It's a requirement that Ethernet packets must at least have a size of
> (60/64/68?, can't remember exactly) bytes.

64 bytes for 10/100
512 bytes for GE

> If a user (protocol) doesn't
> provide "enough" bytes, the network hardware (or driver) will pad until
> this size requirement is reached. It will usually add just bogus data.
>
> Some hardware may append the 4 bytes Ethernet FCS (Frame Check Sequence,
> 4 byte CRC) of the packet while others may not.
>
> So this trailer will usually tell you just about nothing.

As I'm referring to the same Source MAC (which is a GE port) this should 
at least by consistent, shouldn't it? So if it uses bogus data for 
filling when sending the first frame it will also do when sending the 
next. And it looks quite unlikely to me to see the same pattern/trailer 
~5900 times when looking at ~9200 frames ... Right? Or do I miss something?


Regards, Arnold
--
Arnold Nipper, AN45