[En-Nut-Discussion] Ethereal - RTL8019AS data length mismatch

[Bengt Florin]

1. Yes, 60 bytes is min and the driver pads with NUL bytes.
   Does Ethereal really show the length of the ethernet frame or just the
length of the received
   IP packet?
2. The extra spaces are the padding done by the transmitting host to make if
>60 bytes.
    This padding is not shown in the IP header but only in the ethernet
frame, of course.

So things are probably quite normal.

rgds
bengan

  -----Original Message-----
  From: en-nut-discussion-bounces at egnite.de
[mailto:en-nut-discussion-bounces at egnite.de]On Behalf Of HeltonGA at aol.com
  Sent: den 17 februari 2004 06:37
  To: en-nut-discussion at egnite.de
  Subject: [En-Nut-Discussion] Ethereal - RTL8019AS data length mismatch


  I am a bit confused about some results that I'm seeing in message lengths
captured. Using Ethereal to capture traffic, I try to establish a TCP
connection using SuperScan4.0. Ethereal reports a TCP message that is 54
bytes ("54 bytes on wire, 54 bytes captured") in length with SYN bit set,
Seq Num xxxx, yada, yada, yada. Anyway - why is the message length 54 bytes
? Isn't the minimum message length supposed to be 60 bytes for Ethernet ?

  Now on to the RTL8019AS. I captured this same message on my development
board. When I read the message length from the message header, it is 64
bytes. Subtract out the 4 bytes for the CRC and there are 60 data bytes.
Just what I would have expected. When I read out the 60 bytes from the
RTL8019 and buffer them, there are 54 bytes that comprise the Ethernet
Header, IP Header, and TCP Header (14 + 20 + 20) plus 6 space characters
(0x20).

  Why is there an apparent mismatch in data lengths ?  Is Ethereal just
ignoring the extra space characters or is the RTL8019 making them up ?

  By the way, the IP Total Length field is (40). This would account for the
IP Header and TCP Header, but would not account for any "extra" spaces
(pads) appended as TCP data.

  Does anyone know what's going on here ?

  Thanks in advance.
  Fiz
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.egnite.de/pipermail/en-nut-discussion/attachments/20040217/0b827029/attachment.html>