[RK_2014_0923]wireshark捕捉到的Ethernet II数据包的最小长度为60
一、关于wireshark中以太网数据包的最小长度，请看下面的文字：
Packet format
A physical Ethernet packet will look like this:
|
Preamble |
Destination MAC address |
Source MAC address |
Type/Length |
User Data |
Frame Check Sequence (FCS) |
|
8 |
6 |
6 |
2 |
46 - 1500 |
4 |
As the Ethernet hardware filters the preamble, it is not given to Wireshark or any other application. Most Ethernet interfaces also either don‘t supply the FCS to Wireshark or other applications, or aren‘t configured by their driver to do so; therefore, Wireshark will typically only be given the green fields, although on some platforms, with some interfaces, the FCS will be supplied on incoming packets.
Allowed Packet Lengths
Ethernet packets with less than the minimum 64 bytes for an Ethernet packet (header + user data + FCS) are padded to 64 bytes, which means that if there‘s less than 64-(14+4) = 46 bytes of user data, extra padding data is added to the packet.
【注1】在wireshark中，捕捉到的ARP数据包的长度，很多时候是42bytes，有时候是60bytes。
这个长度取决于发送ARP Request端的操作系统的ARP包编码方式【是否在ARP数据包末端添加18个0x00的padding】
【注2】有的TCP或UDP数据包的长度也可能小于60bytes。
二、原文网址[原文发布于2014-09-23 22:44]
http://www.cnblogs.com/tom-and-jerry/p/3988109.html
【完结】
郑重声明：本站内容如果来自互联网及其他传播媒体，其版权均属原媒体及文章作者所有。转载目的在于传递更多信息及用于网络分享，并不代表本站赞同其观点和对其真实性负责，也不构成任何其他建议。
