[Guy Harris <guy@xxxxxxxxxx>]

> I noticed that when Ethereal displays an ARP packet, if the opcode
> of the ARP packet is REPLY, then in the Ethernet_II breakdown,
> it will show the Trailer field (padding, as I understand it, to
> meet the minimum requirement of Ethernet_II data size).
> 
> However, when the packet is ARP REQUEST, it does not show this
> packet! Why? Is it some oversight/error or is there not supposed
> to be any data there?

If an Ethernet packet is received by a machine running a packet-capture
program, the network interface will probably report to the host a length
equal to the actual length of the packet, which would include padding.

However, if the packet is *sent* by that machine, and "looped back" to
the packet-capture mechanism, the length might be based on the length of
the packet as constructed by the protocol on top of Ethernet, and not
include the padding - if, for example, the padding is added after the
packet is looped back, that might be the case.

I think that might be the case on Linux sysstems, for example, and,
given that you mention PF_PACKET, you're using a Linux system.

Were the ARP requests those *received* by the machine, or *sent* by the
machine?