Ethereal-users: Re: [Ethereal-users] Meaning of Trailer in Ethernet frames

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Arnold Nipper <arnold@xxxxxxxxx>
Date: Thu, 02 Jun 2005 22:57:13 +0200
On 02.06.2005 22:39 Ulf Lamping wrote

Arnold Nipper wrote:

I would have expected that the "Trailer" as in

Frame 316560 (60 bytes on wire, 60 bytes captured)
     Type: ARP (0x0806)
     Trailer: 0000020100020100430500D89EBC6C30...

is always the same when Sender MAC/IP address, Target IP address and
Destination (here: broadcast) is always the same or always different
(modulo 2^lenght).

But when looking at roughly 9200 frames I found only 34 different
Trailers with frequency ranging from 1 to ~5900.

Or does the same Trailer indicate that the frame was counted twice due
to L2 loop?

Simply speaking, the trailer probably doesn't tell you anything.

It's a requirement that Ethernet packets must at least have a size of
(60/64/68?, can't remember exactly) bytes.

64 bytes for 10/100
512 bytes for GE

If a user (protocol) doesn't
provide "enough" bytes, the network hardware (or driver) will pad until
this size requirement is reached. It will usually add just bogus data.

Some hardware may append the 4 bytes Ethernet FCS (Frame Check Sequence,
4 byte CRC) of the packet while others may not.

So this trailer will usually tell you just about nothing.


As I'm referring to the same Source MAC (which is a GE port) this should at least by consistent, shouldn't it? So if it uses bogus data for filling when sending the first frame it will also do when sending the next. And it looks quite unlikely to me to see the same pattern/trailer ~5900 times when looking at ~9200 frames ... Right? Or do I miss something?


Regards, Arnold
--
Arnold Nipper, AN45