Ethereal-users: Re: [Ethereal-users] Short Frame - What means?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Thu, 15 Sep 2005 16:07:32 -0700
Feeny, Michael (TD&DS, Applications Infrastructure Svcs.) wrote:

I’m using Ethereal 0.10.12. The trace I’m currently examining shows [Short Frame] for many of the packets. Can anyone point me to an explanation of this diagnostic?

It usually means that the capture was done with a "snapshot length" or with "slicing", so that only the first N bytes of the packets, for some value of N specified by the user doing the capturing (or, if the capture was done with tcpdump, with the default value of 68 or 96 if the user *didn't* specify a snapshot length), are saved to the file.

How was that trace captured? In the detailed view of the packet, does the top item ("Frame {n}") give a "bytes captured" value less than the "bytes on wire" value for any packets? If so, the capture was done with a snapshot length specified.

In some cases, it will be displayed even if no "snapshot length" was specified; those are bugs.