Ethereal-users: Re: [Ethereal-users] Frame size 2774

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: "Guy Harris" <gharris@xxxxxxxxx>
Date: Tue, 21 Sep 2004 14:40:28 -0700 (PDT)
Paul Bajorek said:
> How can a frame size of 2774 be captured on a 100M
> full duplex Ethernet link?

Because something attempted to put such a packet on the link, and neither
the sending nor receiving hardware rejected the packet?

Or, if you're capturing on the machine sending the packet, because it
*wasn't*, in fact, captured on that link - it was "wrapped around" by the
driver, because no Ethernet interface I know of receives packets it
transmits?

The IP "total length" field in the packet has a value of 2760 bytes, so
the IP layer of the sending machine at the IP leel (205.248.160.254)
thought such a packet length was OK, for whatever reason.