Ethernet trailer

Started by sergeyrar, January 02, 2017, 07:53:14 AM

Previous topic - Next topic

sergeyrar

Hi,

Does someone know what that is? and why it is there...?

Is it just a pcap decoding bug(feature)?


deanwebb

Down in the packet contents, we can see that it's padding added to get the frame to be the correct minimum size.

More info: http://networkengineering.stackexchange.com/questions/7095/wireshark-etherent-ii-trailer-field
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

sergeyrar

Are you sure?

As far as I know the minimum Ethernet frame size is 64 bytes, this one is 126.

deanwebb

Well, why is it 126? What's going on with the sender?
Take a baseball bat and trash all the routers, shout out "IT'S A NETWORK PROBLEM NOW, SUCKERS!" and then peel out of the parking lot in your Ferrari.
"The world could perish if people only worked on things that were easy to handle." -- Vladimir Savchenko
Вопросы есть? Вопросов нет! | BCEB: Belkin Certified Expert Baffler | "Plan B is Plan A with an element of panic." -- John Clarke
Accounting is architecture, remember that!
Air gaps are high-latency Internet connections.

wintermute000

Interesting, I can't explain that off the top of my head or a 30 second google.
You're both correct
- The ethernet trailer is padding added to the end of a frame to make up minimum size
- minimum size is 64 bytes (including 4 byte CRC)

Can't explain why a 126 byte frame has a trailer. Though I can't say I've ever looked into this topic or even ethernet trailers at all!

BTW welcome back sergey!

sergeyrar

Thanks
:pub:

Had too much work lately...