Wireshark · Wireshark-users: Re: [Wireshark-users] captured length > actual length

[Alan Tu <8libra@xxxxxxxxx>]

Andrej, I think ethernet has a frame trailer (or frame check sequence,
FCS) so that the frame has a minimum length. If memory serves, 60
seems about right.

The thing is, some network drivers include the frame trailer in the
data sent to a sniffer, and different network drivers do not.

Alan


On 2/2/11, Andrej van der Zee <andrejvanderzee@xxxxxxxxx> wrote:
> Hi,
>
> I am looking at a packet in Wireshark with:
>
> * data link layer length 14 bytes
> * total IP length of 44 bytes
> => TOTAL = 58 bytes
>
> But, the captured bytes show 60. I was wondering where the extra 2
> bytes come from?
>
> The protocol is NBSS .
>
> Thanks,
> Andrej
> ___________________________________________________________________________
> Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
> Archives:    http://www.wireshark.org/lists/wireshark-users
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
>
> mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
>