Wireshark · Ethereal-users: Re: [Ethereal-users] Meaning of Trailer in Ethernet frames

["Guy Harris" <gharris@xxxxxxxxx>]

Arnold Nipper said:
> As I'm referring to the same Source MAC (which is a GE port) this should
> at least by consistent, shouldn't it?

Why should it be?

> So if it uses bogus data for filling when sending the first frame it
will also do when sending the
> next.

It isn't necessarily "filling" anything; it might just be using whatever
happens to be in memory after the Ethernet payload.  (It arguably
*shouldn't*, as that can leak the contents of memory onto the wire,
but....)

Don't assume that the trailer is necessarily being explictly set to a
given value; that's not necessarily the case, so it's not necessarily the
case that the trailer contents indicate anything significant.

> And it looks quite unlikely to me to see the same pattern/trailer
> ~5900 times when looking at ~9200 frames ... Right?

I know too little about the networking implementation on the OS that's
sending the packets to which you're referring, or the driver for the
adapter used to send the packets, to say whether that'd be unlikely or
not.