Wireshark · Wireshark-users: [Wireshark-users] Ping data size

[Gustavo Vera Heredia <gverah@xxxxxxxxx>]

Hi all members,

I wonder if you could explain me why this happens: I ping from one computer to another one in my network. My ping data size is 2000 bytes but I see that the frames containing the ping request and reply have only 562 bytes, why not 2000??. Why is that?

This is what I can see:

Frame 13 (562 bytes on wire, 562 bytes captured)
Ethernet II, Src: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59), Dst: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
Destination: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
Source: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
Type: IP (0x0800)
Internet Protocol, Src: 10.24.4.13 (10.24.4.13), Dst: 10.24.4.16 (10.24.4.16)
Internet Control Message Protocol
Type: 8 (Echo (ping) request)
Code: 0
Checksum: 0xb577 [correct]
Identifier: 0x0200
Sequence number: 0xc400
Data (2000 bytes)
Frame (562 bytes):

Frame 14 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2), Dst: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
Destination: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
Source: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
Type: IP (0x0800)
Internet Protocol, Src: 10.24.4.16 (10.24.4.16), Dst: 10.24.4.13 (10.24.4.13)
Data (1480 bytes)

Frame 15 (562 bytes on wire, 562 bytes captured)
Ethernet II, Src: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2), Dst: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
Destination: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
Source: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
Type: IP (0x0800)
Internet Protocol, Src: 10.24.4.16 (10.24.4.16), Dst: 10.24.4.13 (10.24.4.13)
Internet Control Message Protocol
Type: 0 (Echo (ping) reply)
Code: 0
Checksum: 0xbd77 [correct]
Identifier: 0x0200
Sequence number: 0xc400
Data (2000 bytes)
Frame (562 bytes):

 

(following frames)

 

Frame 16 (60 bytes on wire, 60 bytes captured)
IEEE 802.3 Ethernet
Logical-Link Control
Spanning Tree Protocol

...

 

No.     Time        Source                Destination           Protocol Info
     17 2.759099    RealtekS_a3:41:b3     Broadcast             ARP      Who has 10.24.4.62?  Tell 10.24.4.11

Frame 17 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: RealtekS_a3:41:b3 (00:e0:4c:a3:41:b3), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
    Destination: Broadcast (ff:ff:ff:ff:ff:ff)
    Source: RealtekS_a3:41:b3 (00:e0:4c:a3:41:b3)
    Type: ARP (0x0806)
    Trailer: 839501100001000000000000204641464B46
Address Resolution Protocol (request)
    Hardware type: Ethernet (0x0001)
    Protocol type: IP (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: request (0x0001)
    Sender MAC address: RealtekS_a3:41:b3 (00:e0:4c:a3:41:b3)
    Sender IP address: 10.24.4.11 (10.24.4.11)
    Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
    Target IP address: 10.24.4.62 (10.24.4.62)

 

 

No.     Time        Source                Destination           Protocol Info
     18 2.842990    RealtekS_a4:d4:10     Broadcast             ARP      Who has 10.24.4.62?  Tell 10.24.4.14

Frame 18 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: RealtekS_a4:d4:10 (00:e0:4c:a4:d4:10), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
    Destination: Broadcast (ff:ff:ff:ff:ff:ff)
    Source: RealtekS_a4:d4:10 (00:e0:4c:a4:d4:10)
    Type: ARP (0x0806)
    Trailer: 80D201100001000000000000204646444444
Address Resolution Protocol (request)
    Hardware type: Ethernet (0x0001)
    Protocol type: IP (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: request (0x0001)
    Sender MAC address: RealtekS_a4:d4:10 (00:e0:4c:a4:d4:10)
    Sender IP address: 10.24.4.14 (10.24.4.14)
    Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
    Target IP address: 10.24.4.62 (10.24.4.62)

 

No.     Time        Source                Destination           Protocol Info
     19 2.931289    RealtekS_a5:9e:5d     Broadcast             ARP      Who has 10.24.4.62?  Tell 10.24.4.17

Frame 19 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: RealtekS_a5:9e:5d (00:e0:4c:a5:9e:5d), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
    Destination: Broadcast (ff:ff:ff:ff:ff:ff)
    Source: RealtekS_a5:9e:5d (00:e0:4c:a5:9e:5d)
    Type: ARP (0x0806)
    Trailer: 81A701100001000000000000204646444444
Address Resolution Protocol (request)
    Hardware type: Ethernet (0x0001)
    Protocol type: IP (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: request (0x0001)
    Sender MAC address: RealtekS_a5:9e:5d (00:e0:4c:a5:9e:5d)
    Sender IP address: 10.24.4.17 (10.24.4.17)
    Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
    Target IP address: 10.24.4.62 (10.24.4.62)

 

 

No.     Time        Source                Destination           Protocol Info
     20 3.045996    RealtekS_a4:d2:ff     Broadcast             ARP      Who has 10.24.4.62?  Tell 10.24.4.10

Frame 20 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: RealtekS_a4:d2:ff (00:e0:4c:a4:d2:ff), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
    Destination: Broadcast (ff:ff:ff:ff:ff:ff)
    Source: RealtekS_a4:d2:ff (00:e0:4c:a4:d2:ff)
    Type: ARP (0x0806)
    Trailer: 3C016A105018FAB47DF8000085000000FF53
Address Resolution Protocol (request)
    Hardware type: Ethernet (0x0001)
    Protocol type: IP (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: request (0x0001)
    Sender MAC address: RealtekS_a4:d2:ff (00:e0:4c:a4:d2:ff)
    Sender IP address: 10.24.4.10 (10.24.4.10)
    Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
    Target IP address: 10.24.4.62 (10.24.4.62)

..

 

No.     Time        Source                Destination           Protocol Info
     21 3.100425    10.24.4.13            10.24.4.16            IP       Fragmented IP protocol (proto=ICMP 0x01, off=0) [Reassembled in #22]

Frame 21 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59), Dst: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
    Destination: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
    Source: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
    Type: IP (0x0800)
Internet Protocol, Src: 10.24.4.13 (10.24.4.13), Dst: 10.24.4.16 (10.24.4.16)
Data (1480 bytes)

 

No.     Time        Source                Destination           Protocol Info
     22 3.100451    10.24.4.13            10.24.4.16            ICMP     Echo (ping) request

Frame 22 (562 bytes on wire, 562 bytes captured)
Ethernet II, Src: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59), Dst: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
    Destination: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
    Source: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
    Type: IP (0x0800)
Internet Protocol, Src: 10.24.4.13 (10.24.4.13), Dst: 10.24.4.16 (10.24.4.16)
Internet Control Message Protocol
    Type: 8 (Echo (ping) request)
    Code: 0
    Checksum: 0xb477 [correct]
    Identifier: 0x0200
    Sequence number: 0xc500
    Data (2000 bytes)

Frame (562 bytes):

...

No.     Time        Source                Destination           Protocol Info
  23 3.101207    10.24.4.16            10.24.4.13            IP       Fragmented IP protocol (proto=ICMP 0x01, off=0) [Reassembled in #24]

Frame 23 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2), Dst: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
    Destination: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
    Source: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
    Type: IP (0x0800)
Internet Protocol, Src: 10.24.4.16 (10.24.4.16), Dst: 10.24.4.13 (10.24.4.13)
Data (1480 bytes)

 

No.     Time        Source                Destination           Protocol Info
     24 3.101222    10.24.4.16            10.24.4.13            ICMP     Echo (ping) reply

Frame 24 (562 bytes on wire, 562 bytes captured)
Ethernet II, Src: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2), Dst: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
    Destination: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
    Source: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
    Type: IP (0x0800)
Internet Protocol, Src: 10.24.4.16 (10.24.4.16), Dst: 10.24.4.13 (10.24.4.13)
Internet Control Message Protocol
    Type: 0 (Echo (ping) reply)
    Code: 0
    Checksum: 0xbc77 [correct]
    Identifier: 0x0200
    Sequence number: 0xc500
    Data (2000 bytes)

Frame (562 bytes):

...
No.     Time        Source                Destination           Protocol Info
     25 3.760546    RealtekS_a3:41:b3     Broadcast             ARP      Who has 10.24.4.62?  Tell 10.24.4.11

Frame 25 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: RealtekS_a3:41:b3 (00:e0:4c:a3:41:b3), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
    Destination: Broadcast (ff:ff:ff:ff:ff:ff)
    Source: RealtekS_a3:41:b3 (00:e0:4c:a3:41:b3)
    Type: ARP (0x0806)
    Trailer: 6162636465666768696A6B6C6D6E6F707172
Address Resolution Protocol (request)
    Hardware type: Ethernet (0x0001)
    Protocol type: IP (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: request (0x0001)
    Sender MAC address: RealtekS_a3:41:b3 (00:e0:4c:a3:41:b3)
    Sender IP address: 10.24.4.11 (10.24.4.11)
    Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
    Target IP address: 10.24.4.62 (10.24.4.62)

 

No.     Time        Source                Destination           Protocol Info
     26 3.999347    RealtekS_c2:f4:69     Broadcast             ARP      Who has 10.23.3.62?  Tell 10.23.3.15

Frame 26 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: RealtekS_c2:f4:69 (00:e0:4c:c2:f4:69), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
    Destination: Broadcast (ff:ff:ff:ff:ff:ff)
    Source: RealtekS_c2:f4:69 (00:e0:4c:c2:f4:69)
    Type: ARP (0x0806)
    Trailer: 83F9AD86000000010000000020454D454245
Address Resolution Protocol (request)
    Hardware type: Ethernet (0x0001)
    Protocol type: IP (0x0800)
    Hardware size: 6
    Protocol size: 4
    Opcode: request (0x0001)
    Sender MAC address: RealtekS_c2:f4:69 (00:e0:4c:c2:f4:69)
    Sender IP address: 10.23.3.15 (10.23.3.15)
    Target MAC address: 00:00:00_00:00:00 (00:00:00:00:00:00)
    Target IP address: 10.23.3.62 (10.23.3.62)

No.     Time        Source                Destination           Protocol Info
     27 4.101803    10.24.4.13            10.24.4.16            IP       Fragmented IP protocol (proto=ICMP 0x01, off=0) [Reassembled in #28]

Frame 27 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59), Dst: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
    Destination: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
    Source: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
    Type: IP (0x0800)
Internet Protocol, Src: 10.24.4.13 (10.24.4.13), Dst: 10.24.4.16 (10.24.4.16)
Data (1480 bytes)

....
No.     Time        Source                Destination           Protocol Info
     28 4.101824    10.24.4.13            10.24.4.16            ICMP     Echo (ping) request

Frame 28 (562 bytes on wire, 562 bytes captured)
Ethernet II, Src: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59), Dst: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
    Destination: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2)
    Source: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59)
    Type: IP (0x0800)
Internet Protocol, Src: 10.24.4.13 (10.24.4.13), Dst: 10.24.4.16 (10.24.4.16)
Internet Control Message Protocol
    Type: 8 (Echo (ping) request)
    Code: 0
    Checksum: 0xb377 [correct]
    Identifier: 0x0200
    Sequence number: 0xc600
    Data (2000 bytes)

Frame (562 bytes):


Thanks in advance!!!