cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
55192
Views
0
Helpful
5
Replies

ICMP packet size?

get_rthym
Level 1
Level 1

Hello there,

i sniffed ping packet, frame size says 74 bytes.

which would be 20 bytes of IP header, 8 bytes of ICMP header + 32 data, 18 bytes of min ethernet frame.

In my case i did ping of win xp, 32 bytes of data.

So, adding up, 20+8+32+18=78 bytes. But the sniffed packet says 74 bytes total frame on wire.

After some research, i found that ethernet frame is taken as 6 byte D.A+6 byte S.A+ 2 byte type = 14 bytes.

And there is no CRC byte added. With this, the frame packet will be 74 bytes exactly.

Can someone please tell me why CRC is not included in ethernet frame?

lek

2 Accepted Solutions

Accepted Solutions

I would say you should check some docs on sniffer if you are using. For example wireshark does not capture that field you can make it work but i cant suggest on that.

Thanks
Ajay

View solution in original post

lek

There are several ways of looking at this. One way, which you suggest, is when we look at what is transmitted on the wire for an Ethernet frame there is a CRC which comes at the end. Since the CRC bits are transmitted as part of the frame we should count them in the byte count of the frame.

Another way of looking at it is that since the CRC is used to detect errors in the transmitted frame, and since the CRC is calculated by doing a checksum on the frame, then the CRC can not be part of the frame itself

HTH

Rick

HTH

Rick

View solution in original post

5 Replies 5

ajay chauhan
Level 7
Level 7

6 bytes DA + 6 bytes SA + 2 bytes Type + 20 bytes IP header + 4 bytes ICMP header + 4 bytes identifier+sequence number + 32 bytes actual data = 74

Here is how 74 is calculated.

Thanks

Ajay

I think this is how it became 74:

ip header = 20, ethernet frame minimum is 64 bytes if not specify the size.

Inside ethernet frame = icmp header (8bytes) + data.

Data is 64 bytes - 8 bytes = 56 bytes.

So overall:

ip header (20) + icmp header (8) + data (56) = 74 bytes.

example:

ping 8.8.8.8

PING 8.8.8.8 (8.8.8.8): 56 data bytes

64 bytes from 8.8.8.8: icmp_seq=0 ttl=57 time=11.643 ms

64 bytes from 8.8.8.8: icmp_seq=1 ttl=57 time=20.087 ms

get_rthym
Level 1
Level 1

Hi Ajay,

Thank s for the reply.

Yea, that will sum up to exact 74 bytes. Btw, my question where is Ethernet CRC (4 bytes).

lek

I would say you should check some docs on sniffer if you are using. For example wireshark does not capture that field you can make it work but i cant suggest on that.

Thanks
Ajay

lek

There are several ways of looking at this. One way, which you suggest, is when we look at what is transmitted on the wire for an Ethernet frame there is a CRC which comes at the end. Since the CRC bits are transmitted as part of the frame we should count them in the byte count of the frame.

Another way of looking at it is that since the CRC is used to detect errors in the transmitted frame, and since the CRC is calculated by doing a checksum on the frame, then the CRC can not be part of the frame itself

HTH

Rick

HTH

Rick
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Innovations in Cisco Full Stack Observability - A new webinar from Cisco