Ethereal-users: Re: [Ethereal-users] Understanding tethereal output

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 25 Aug 2003 18:27:44 -0700

On Monday, August 25, 2003, at 3:34 PM, Jason Lixfeld wrote:

So why would the length of the layer 2 frame not be expressed, but the length of the layer 3+ datagrams would be expressed?

Because that's generally implicit in the framing at the physical or logical link layer. In DEC/Intel/Xerox Ethernet, for example, there is no length field in the Ethernet header - the length is implicit in the physical framing. (802.3 changed the Ethernet type field to a type/length field, for the benefit of protocols that

1) would send packets larger than the minimum payload length on Ethernet

and

2) don't have a mechanism, such as the IP length field, to specify how much of that payload is packet data and how much of it is padding. Many other link-layer protocols have no such padding, and have no length field under any circumstances.)

The length of the link-layer frame is the "Packet Length" value under "Frame {N}"; it's put there because it's not a field in the link-layer header.