Ethereal-users: Re: [Ethereal-users] Understanding tethereal output

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 25 Aug 2003 18:27:44 -0700
On Monday, August 25, 2003, at 3:34 PM, Jason Lixfeld wrote:

So why would the length of the layer 2 frame not be expressed, but the length of the layer 3+ datagrams would be expressed?
Because that's generally implicit in the framing at the physical or 
logical link layer.  In DEC/Intel/Xerox Ethernet, for example, there is 
no length field in the Ethernet header - the length is implicit in the 
physical framing.  (802.3 changed the Ethernet type field to a 
type/length field, for the benefit of protocols that
	1) would send packets larger than the minimum payload length on 
Ethernet
and

2) don't have a mechanism, such as the IP length field, to specify how much of that payload is packet data and how much of it is padding. Many other link-layer protocols have no such padding, and have no length field under any circumstances.)
The length of the link-layer frame is the "Packet Length" value under 
"Frame {N}"; it's put there because it's not a field in the link-layer 
header.