[En-Nut-Discussion] Ethereal - RTL8019AS data length mismatch

[HeltonGA at aol.com]

I am a bit confused about some results that I'm seeing in message lengths 
captured. Using Ethereal to capture traffic, I try to establish a TCP connection 
using SuperScan4.0. Ethereal reports a TCP message that is 54 bytes ("54 bytes 
on wire, 54 bytes captured") in length with SYN bit set, Seq Num xxxx, yada, 
yada, yada. Anyway - why is the message length 54 bytes ? Isn't the minimum 
message length supposed to be 60 bytes for Ethernet ?

Now on to the RTL8019AS. I captured this same message on my development 
board. When I read the message length from the message header, it is 64 bytes. 
Subtract out the 4 bytes for the CRC and there are 60 data bytes. Just what I 
would have expected. When I read out the 60 bytes from the RTL8019 and buffer 
them, there are 54 bytes that comprise the Ethernet Header, IP Header, and TCP 
Header (14 + 20 + 20) plus 6 space characters (0x20).

Why is there an apparent mismatch in data lengths ?  Is Ethereal just 
ignoring the extra space characters or is the RTL8019 making them up ?

By the way, the IP Total Length field is (40). This would account for the IP 
Header and TCP Header, but would not account for any "extra" spaces (pads) 
appended as TCP data.

Does anyone know what's going on here ?

Thanks in advance.
Fiz
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.egnite.de/pipermail/en-nut-discussion/attachments/20040217/05d7e9fe/attachment.html>