Title: Ping packet sizes
Hi all,
I have searched through the list archives, but alas no luck so I hope someone here can illuminate an interesting thing I noticed with ping packet sizes. (To my understanding anyway!)
Here's the setup. I have one PC connected to another PC with a few Cisco routers in between. They can ping each other happily. I know Ethereal doesn't report packet sizes as seen by the network if its running on the same machine that's generating the traffic, in this case ping requests. I also know that Ethereal doesn't report the Frame Check Sequence (FCS) of the ethernet frame, so packet sizes are always 4 bytes less than what they should be. So, the minimum size I see should be 60 bytes.
I setup another PC connected to the switch on one side of the link and created a SPAN session and run Ethereal. I then did a standard ping (this is on Windows BTW) from the other PC - This generates the expected 74 bytes (8 bytes preamble + 6 bytes DA + 6 bytes SA + 2 bytes Type + 20 bytes IP header + 32 bytes ICMP payload, ignoring the 4 bytes FCS). More importantly, the echo reply is also 74 bytes.
I then proceded to reduce the ICMP payload using the "-l" (dash el) option to 1 byte. The echo request packet size drop to 56 bytes yet the reply is 60 bytes! In the request ethernet frame, there is a padding of 13 bytes (so 8+6+6+2+13+20+1=56) - my question is: why 56 bytes? As explained, I expected the minimum packet size visible to Ethereal would be 60 bytes (min Ethernet frame minus FCS). Where did the other bytes go? I have a small capture file - available on request.
Kind regards,
Damien.
DISCLAIMER:-----------------------------------------------------------------------------------------------
This Email may contain confidential and/or privileged information and is intended
solely for the addressee(s) named. If you have received this information in error, or
are advised that you have been posted this Email by accident, please notify the
sender by return Email, do not redistribute it, delete the Email and keep no copies.
----------------------------------------------------------------------------------------------------------------------