Arnold Nipper wrote:
> I would have expected that the "Trailer" as in
>
> Frame 316560 (60 bytes on wire, 60 bytes captured)
> Arrival Time: May 26, 2005 21:15:44.694770000
> Time delta from previous packet: 0.000141000 seconds
> Time since reference or first frame: 43.566940000 seconds
> Frame Number: 316560
> Packet Length: 60 bytes
> Capture Length: 60 bytes
> Ethernet II, Src: xx:xx:xx:xx:xx, Dst: ff:ff:ff:ff:ff:ff
> Destination: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)
> Source: xx:xx:xx:xx:xx (xx:xx:xx:xx:xx)
> Type: ARP (0x0806)
> Trailer: 0000020100020100430500D89EBC6C30...
> Address Resolution Protocol (request)
> Hardware type: Ethernet (0x0001)
> Protocol type: IP (0x0800)
> Hardware size: 6
> Protocol size: 4
> Opcode: request (0x0001)
> Sender MAC address: xx:xx:xx:xx:xx (xx:xx:xx:xx:xx)
> Sender IP address: X.X.X.X (X.X.X.X)
> Target MAC address: 00:00:00:00:00:00 (00:00:00:00:00:00)
> Target IP address: Y.Y.Y.Y (Y.Y.Y.Y)
>
> is always the same when Sender MAC/IP address, Target IP address and
> Destination (here: broadcast) is always the same or always different
> (modulo 2^lenght).
>
> But when looking at roughly 9200 frames I found only 34 different
> Trailers with frequency ranging from 1 to ~5900.
>
> Or does the same Trailer indicate that the frame was counted twice due
> to L2 loop?
Simply speaking, the trailer probably doesn't tell you anything.
It's a requirement that Ethernet packets must at least have a size of
(60/64/68?, can't remember exactly) bytes. If a user (protocol) doesn't
provide "enough" bytes, the network hardware (or driver) will pad until
this size requirement is reached. It will usually add just bogus data.
Some hardware may append the 4 bytes Ethernet FCS (Frame Check Sequence,
4 byte CRC) of the packet while others may not.
So this trailer will usually tell you just about nothing.
Regards, ULFL
