Wireshark · Ethereal-users: Re: [Ethereal-users] Ethernet padding in packets sent from the machine running Ethereal?

[Richard Urwin <richard@xxxxxxxxxxxxxxx>]

On Wednesday 09 Apr 2003 9:13 am, carlos.garciagarcia@xxxxxxxxxxxxxxxxxxx 
wrote:
> Hi everybody.
>
> I 've been doing ping tests with very small packets (a couple of data
> bytes), while capturing the packets with Ethereal. The pings were initiated
> (or directed) against the machine running Ethereal. The packets involved
> are smaller than the mininum Ethernet size and must be padded.
>
> I have found this (strange?) situation in the traces captured. An example
> trace is attached.
>
> - The packets received by Ethereal have a frame length of 60, so the
> Ethernet padding is taken into account.
>
> - But the packets send by the computer which is running Ethereal have
> shorter lengths (43), so the Ethernet padding is not taken into account.
>
> Is this normal? My OS is Windows 2000 / NT.
>
> Thanks in advance.
>
> Carlos

Yes it is normal. The ethernet packing will usually be done by the ethernet 
chip on the NIC. Outgoing packets are tapped off before they get to the NIC, 
so the padding has not been added.

If you try running Ethereal on another machine you will find that the padding 
has been added.

A related question that crops up here every so often is that the NIC often 
handles the TCP and UDP CRCs, so outgoing packets seem to have invalid CRCs.

-- 
Richard Urwin