["Stewart, Damien" <damien.r.stewart@xxxxxxxxxxxxxxx>]

Guy,

That's right, my Ethereal box is effectively between host A and host B.
Actually, the setup is like this:

Host A <---> 2600 <---> 2800 <---> 2800 <---> 2600 <---> Host B

My Ethereal box is monitoring a SPANed port on the second 2800 there. As
previously mentioned, for the standard ping packet issued from windows (with
a default ICMP data payload of 32 bytes) Ethereal shows 60 bytes. But for
non-default sizes of 1 byte, there is a discrepancy between the ICMP request
and ICMP reply overall packet sizes.

Now you mention that there's a lot of things outside of the control of
Ethereal developers but in the given configuration, both hosts are running
windows 2000, each Cisco router is running the same IOS and same switching
modules, yet there is a difference in the request and replies which is a
little odd. It would be interesting if anyone could replicate the situation.

Yet, it is minor as with the default sizes everything seems ok...

Kind regards,

Damien.

> -----Original Message-----
> From: Guy Harris [mailto:gharris@xxxxxxxxx] 
> Sent: Monday, 24 October 2005 11:56 AM
> To: Ethereal user support
> Subject: Re: [Ethereal-users] Ping packet sizes
> 
> Stewart, Damien wrote:
> 
> > Yes I am aware that Ethereal can't see all of the packet when it's 
> > running on a machine the packet is generated from. However, in this 
> > particular case, when I noticed the discrepancy between 
> ping request 
> > and ping replies, Ethereal was monitoring a SPAN session on 
> a Cisco router.
> 
> I.e., the machine running Ethereal was *not* the one sending 
> the pings?
> 
> > It's a minor issue, but it would be nice to know exactly in what 
> > situations Ethereal will correctly report packet sizes
> 
> It will report what's handed to it by the packet capture mechanism. 
> That will be correct, in the sense that it will reflect the 
> size of the packet as received (which isn't necessarily the 
> size of the packet as sent - the hardware passing the packet 
> along might change it) if the adapter (which we, the Ethereal 
> developers, don't control) and its driver (which we don't 
> control) and the capture code in the OS (+the WinPcap driver 
> on windows) (we don't control them, either) don't modify the 
> packet size.
> 
> Whether it will include the CRC or not depends on whether the 
> adapter+driver+capture mechanism include the CRC in the 
> captured packet
> (yup, that's another thing the Ethereal developers don't control).
> 
> All the platforms on which I've captured used supply the 
> correct length 
> for received packets.  I can't speak for the others.
> 
> 
> 


DISCLAIMER:-----------------------------------------------------------------------------------------------
This Email may contain confidential and/or privileged information and is intended 
solely for the addressee(s) named. If you have received this information in error, or
are advised that you have been posted this Email by accident, please notify the 
sender by return Email, do not redistribute it, delete the Email and keep no copies.
----------------------------------------------------------------------------------------------------------------------