Gianluca Varenni wrote:
The minimum ethernet frame length is 64 bytes *if* you include the FCS.
Unfortunately, most of the network cards strip the FCS before the packet
reaches the host, so the actual minimum frame length that you see with
libpcap is actually 60 bytes.
Hope it helps
Yes it does. Thanks.
But a question arises: If my network card is stripping the FCS (and it
seems to do so), may I suppose that this is done for all packets? In
other words, it is safe to add 4 bytes to the sizes of *all* captured
packets to get the sizes on wire?
*david
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.
