You probably aren't counting the checksum bytes.
An Ethernet frame consists of a 14 byte header, data, and 4 bytes of
checksum. The minimum packet size should be 64, which leaves 64 - 4 - 14 =
46 bytes for data, or 60 bytes without the checksum
I suspect the frame you captured was actually 2 bytes longer than the
minimum. When I look on my LAN, most short packets are 64 bytes (not
counting the checksum), and a few are 60.
At 02:32 PM 8/11/2005, jairo.morales01@xxxxxxxxxx wrote:
Some days ago I wrote in this list a message asking about the ethernet frame
length because I was capturing a 42 bytes ethernet frame instead a 64
bytes one
(all you know that 64 is the standard size). A person answered me and wrote:
"That's because the way frames being sent by the machine running Ethereal
(or any other capture program) are "captured" not by being read from the
network (most if not all Ethernet interfaces don't receive packets that
they send) but by being internally supplied to the mechanism being used
for capture.
That's done *before* the packet is padded out to the minimum 64-byte
length for transmission on Ethernet, so those packets aren't padded; that
padding is what Ethereal reports as the Trailer"
So I captured the packet in other PC, different to the PC which sent the
packets, then I could capture a 62 bytes packet, but, why it is still shorter
than the 64 bytes standard size?