Ethereal-users: Re: [Ethereal-users] determining packet size

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Fri, 2 Nov 2001 18:02:33 -0800 (PST)
> FTP Data: 1436 bytes
> 
> Would I be correct in assumeing that this is total size of the packet?

No.

You would be correct in assuming that this is the amount of data in the
packet that's FTP data, rather than link-layer, IP, or TCP headers.  The
total size of the packet, however, includes the link-layer, IP, and TCP
headers.

The total size of the packet can be found either

	in the "Frame N" line in the protocol tree window for the
	packet (the "on wire" value), or the "Packet Length" field that
	appears if you open up that line

or

	in the packet list window *if* you add a new column from the
	dialog box popped up by the "Preferences" item in the "Edit"
	menu; enter a name for the new column in "Column title:", select
	"Packet length (bytes)" from the "Column format:" option menu,
	click "New", click "Save", click "OK", and then exit and restart
	Ethereal (alas, we currently don't update the display on the
	fly; that will probably happen some day, but it requires more
	stuff to be changed than you might think).