(Note to self: If netscape crashes when sending mail again, throttle the
dang thing)
Hi, sorry if the third in you inbox (this is just getting silly).
I have been making a toy ethernet sniffer/decoder, and its having
trouble on ARP packets, so I decided to compare my results with
Ethereal, as I often had been doing.
I noticed that when Ethereal displays an ARP packet, if the opcode
of the ARP packet is REPLY, then in the Ethernet_II breakdown,
it will show the Trailer field (padding, as I understand it, to
meet the minimum requirement of Ethernet_II data size).
However, when the packet is ARP REQUEST, it does not show this
packet! Why? Is it some oversight/error or is there not supposed
to be any data there?
PS. Then reading frames in using PF_PACKET and SOCK_RAW, does
the data have any padding stripped off?
Thanks. All input appreciated.
PPS. Please cc replies to my email, since I am not a member of
this group. Thanks.
(Now remember to save, BEFORE you send...)
--
Cameron Kerr -- cameron.kerr @ paradise.net.nz
Praise Slackware, our baud and saviour!
--
