【TCP/IP】wireshark捕捉到的Ethernet II數據包的最小長度爲60

1、關於wireshark中以太網數據包的最小長度，請看下面的文字：

Packet format

A physical Ethernet packet will look like this:

Preamble	Destination MAC address	Source MAC address	Type/Length	User Data	Frame Check Sequence (FCS)
8	6	6	2	46 - 1500	4

As the Ethernet hardware filters the preamble, it is not given to Wireshark or any other application. Most Ethernet interfaces also either don't supply the FCS to Wireshark or other applications, or aren't configured by their driver to do so; therefore, Wireshark will typically only be given the green fields, although on some platforms, with some interfaces, the FCS will be supplied on incoming packets.

Allowed Packet Lengths

Ethernet packets with less than the minimum 64 bytes for an Ethernet packet (header + user data + FCS) are padded to 64 bytes, which means that if there's less than 64-(14+4) = 46 bytes of user data, extra padding data is added to the packet.

 【注1】在wireshark中，捕捉到的ARP數據包的長度，不少時候是42bytes，有時候是60bytes。

這個長度取決於發送ARP Request端的操做系統的ARP包編碼方式【是否在ARP數據包末端添加18個0x00的padding】

【注2】有的TCP或UDP數據包的長度也可能小於60bytes。

  

2、原文網址[原文發佈於2014-09-23 22:44]

http://www.cnblogs.com/tom-and-jerry/p/3988109.html

 

【完結】