标签：des style blog http color io os ar for
一、关于wireshark中以太网数据包的最小长度，请看下面的文字：
A physical Ethernet packet will look like this:
|
Preamble |
Destination MAC address |
Source MAC address |
Type/Length |
User Data |
Frame Check Sequence (FCS) |
|
8 |
6 |
6 |
2 |
46 - 1500 |
4 |
As the Ethernet hardware filters the preamble, it is not given to Wireshark or any other application. Most Ethernet interfaces also either don‘t supply the FCS to Wireshark or other applications, or aren‘t configured by their driver to do so; therefore, Wireshark will typically only be given the green fields, although on some platforms, with some interfaces, the FCS will be supplied on incoming packets.
Ethernet packets with less than the minimum 64 bytes for an Ethernet packet (header + user data + FCS) are padded to 64 bytes, which means that if there‘s less than 64-(14+4) = 46 bytes of user data, extra padding data is added to the packet.
【注1】在wireshark中，捕捉到的ARP数据包的长度，很多时候是42bytes，有时候是60bytes。
这个长度取决于发送ARP Request端的操作系统的ARP包编码方式【是否在ARP数据包末端添加18个0x00的padding】
【注2】有的TCP或UDP数据包的长度也可能小于60bytes。
二、原文网址[原文发布于2014-09-23 22:44]
http://www.cnblogs.com/tom-and-jerry/p/3988109.html
【完结】
[RK_2014_0923]wireshark捕捉到的Ethernet II数据包的最小长度为60
标签：des style blog http color io os ar for
原文地址：http://www.cnblogs.com/tom-and-jerry/p/3988109.html
