On Wed, 2005-11-23 at 23:49 +0100, David Rosal wrote:
> Gianluca Varenni wrote:
> > The minimum ethernet frame length is 64 bytes *if* you include the FCS.
> > Unfortunately, most of the network cards strip the FCS before the packet
> > reaches the host, so the actual minimum frame length that yo
David Rosal wrote:
Yes it does. Thanks.
But a question arises: If my network card is stripping the FCS (and it
seems to do so), may I suppose that this is done for all packets?
On that particular adapter, yes.
You can't suppose that it's done on all adapters on all platforms,
however; in pa
Gianluca Varenni wrote:
The minimum ethernet frame length is 64 bytes *if* you include the FCS.
Unfortunately, most of the network cards strip the FCS before the packet
reaches the host, so the actual minimum frame length that you see with
libpcap is actually 60 bytes.
Hope it helps
Yes it
David Rosal wrote:
[ ... ]
But what's is very strange is that
everytime I make a capture session with tcpdump I get *many* packets of
60 bytes that are not originated in my own machine nor are them sent to it.
Here's an example of the output of tcpdump:
$ tcpdump -c5 '(host not 193.145.45.23
- Original Message -
From: "David Rosal" <[EMAIL PROTECTED]>
To:
Sent: Wednesday, November 23, 2005 5:26 AM
Subject: [tcpdump-workers] Paquets smaller than 64 bytes
Hello.
I'm monitoring an Ethernet link with tcpdump-3.9.4.
I've read that when packets
Hello.
I'm monitoring an Ethernet link with tcpdump-3.9.4.
I've read that when packets are generated by the same machine as tcpdump
is run, those packets may be smaller than the minimum ethernet frame
lenght, which is of 64 bytes. AFAIK, this is because the kernel "sends"
the packets to pcap
