Wireshark-users: [Wireshark-users] Incorrect report by wireshark ?
From: Saikiran Madugula <[email protected]>
Date: Wed, 26 Sep 2007 17:03:10 -0400
Hello,

I am new to wireshark. Following is a capture of a frame
by wireshark (tshark -V). I always though that
Ethernet frames are of minimum length 64bytes. How can
wireshark say that the frame is indeed 60 bytes on wire, while
it is 64 (including CRC).

Thanks,
Kiran.

Frame 4 (60 bytes on wire, 60 bytes captured)
    Arrival Time: Sep 26, 2007 16:34:50.149557000
    [Time delta from previous captured frame: 0.009585000 seconds]
    [Time delta from previous displayed frame: 0.009585000 seconds]
    [Time since reference or first frame: 1190838890.149557000 seconds]
    Frame Number: 4
    Frame Length: 60 bytes
    Capture Length: 60 bytes
    [Frame is marked: False]
    [Protocols in frame: eth:arp]
Ethernet II, Src: Foxconn_80:01:72 (00:15:58:80:01:72), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
    Destination: Broadcast (ff:ff:ff:ff:ff:ff)
        Address: Broadcast (ff:ff:ff:ff:ff:ff)
.... ...1 .... .... .... .... = IG bit: Group address (multicast/broadcast) .... ..1. .... .... .... .... = LG bit: Locally administered address (this is NOT the factory default)
    Source: Foxconn_80:01:72 (00:15:58:80:01:72)
        Address: Foxconn_80:01:72 (00:15:58:80:01:72)
.... ...0 .... .... .... .... = IG bit: Individual address (unicast) .... ..0. .... .... .... .... = LG bit: Globally unique address (factory default)
    Type: ARP (0x0806)
    Trailer: 000000000000000000000000000000000000
Address Resolution Protocol (request)
    Hardware type: Ethernet (0x0001)
    Protocol type: IP (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: request (0x0001)
    Sender MAC address: Foxconn_80:01:72 (00:15:58:80:01:72)
    Sender IP address: 192.168.3.45 (192.168.3.45)
    Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
    Target IP address: 192.168.3.117 (192.168.3.117)