11-24-2011 10:12 PM - edited 03-07-2019 03:35 AM
Hello there,
i sniffed ping packet, frame size says 74 bytes.
which would be 20 bytes of IP header, 8 bytes of ICMP header + 32 data, 18 bytes of min ethernet frame.
In my case i did ping of win xp, 32 bytes of data.
So, adding up, 20+8+32+18=78 bytes. But the sniffed packet says 74 bytes total frame on wire.
After some research, i found that ethernet frame is taken as 6 byte D.A+6 byte S.A+ 2 byte type = 14 bytes.
And there is no CRC byte added. With this, the frame packet will be 74 bytes exactly.
Can someone please tell me why CRC is not included in ethernet frame?
lek
Solved! Go to Solution.
11-25-2011 05:54 AM
I would say you should check some docs on sniffer if you are using. For example wireshark does not capture that field you can make it work but i cant suggest on that.
Thanks
Ajay
11-26-2011 06:46 PM
lek
There are several ways of looking at this. One way, which you suggest, is when we look at what is transmitted on the wire for an Ethernet frame there is a CRC which comes at the end. Since the CRC bits are transmitted as part of the frame we should count them in the byte count of the frame.
Another way of looking at it is that since the CRC is used to detect errors in the transmitted frame, and since the CRC is calculated by doing a checksum on the frame, then the CRC can not be part of the frame itself
HTH
Rick
11-25-2011 04:56 AM
6 bytes DA + 6 bytes SA + 2 bytes Type + 20 bytes IP header + 4 bytes ICMP header + 4 bytes identifier+sequence number + 32 bytes actual data = 74
Here is how 74 is calculated.
Thanks
Ajay
01-18-2016 09:55 PM
I think this is how it became 74:
ip header = 20, ethernet frame minimum is 64 bytes if not specify the size.
Inside ethernet frame = icmp header (8bytes) + data.
Data is 64 bytes - 8 bytes = 56 bytes.
So overall:
ip header (20) + icmp header (8) + data (56) = 74 bytes.
example:
ping 8.8.8.8
PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: icmp_seq=0 ttl=57 time=11.643 ms
64 bytes from 8.8.8.8: icmp_seq=1 ttl=57 time=20.087 ms
11-25-2011 05:33 AM
Hi Ajay,
Thank s for the reply.
Yea, that will sum up to exact 74 bytes. Btw, my question where is Ethernet CRC (4 bytes).
lek
11-25-2011 05:54 AM
I would say you should check some docs on sniffer if you are using. For example wireshark does not capture that field you can make it work but i cant suggest on that.
Thanks
Ajay
11-26-2011 06:46 PM
lek
There are several ways of looking at this. One way, which you suggest, is when we look at what is transmitted on the wire for an Ethernet frame there is a CRC which comes at the end. Since the CRC bits are transmitted as part of the frame we should count them in the byte count of the frame.
Another way of looking at it is that since the CRC is used to detect errors in the transmitted frame, and since the CRC is calculated by doing a checksum on the frame, then the CRC can not be part of the frame itself
HTH
Rick
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: