Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

ICMP packet size?

Hello there,

i sniffed ping packet, frame size says 74 bytes.

which would be 20 bytes of IP header, 8 bytes of ICMP header + 32 data, 18 bytes of min ethernet frame.

In my case i did ping of win xp, 32 bytes of data.

So, adding up, 20+8+32+18=78 bytes. But the sniffed packet says 74 bytes total frame on wire.

After some research, i found that ethernet frame is taken as 6 byte D.A+6 byte S.A+ 2 byte type = 14 bytes.

And there is no CRC byte added. With this, the frame packet will be 74 bytes exactly.

Can someone please tell me why CRC is not included in ethernet frame?

lek

  • LAN Switching and Routing
2 ACCEPTED SOLUTIONS

Accepted Solutions

ICMP packet size?

I would say you should check some docs on sniffer if you are using. For example wireshark does not capture that field you can make it work but i cant suggest on that.

Thanks
Ajay

Hall of Fame Super Silver

ICMP packet size?

lek

There are several ways of looking at this. One way, which you suggest, is when we look at what is transmitted on the wire for an Ethernet frame there is a CRC which comes at the end. Since the CRC bits are transmitted as part of the frame we should count them in the byte count of the frame.

Another way of looking at it is that since the CRC is used to detect errors in the transmitted frame, and since the CRC is calculated by doing a checksum on the frame, then the CRC can not be part of the frame itself

HTH

Rick

5 REPLIES

ICMP packet size?

6 bytes DA + 6 bytes SA + 2 bytes Type + 20 bytes IP header + 4 bytes ICMP header + 4 bytes identifier+sequence number + 32 bytes actual data = 74

Here is how 74 is calculated.

Thanks

Ajay

New Member

I think this is how it became

I think this is how it became 74:

ip header = 20, ethernet frame minimum is 64 bytes if not specify the size.

Inside ethernet frame = icmp header (8bytes) + data.

Data is 64 bytes - 8 bytes = 56 bytes.

So overall:

ip header (20) + icmp header (8) + data (56) = 74 bytes.

example:

ping 8.8.8.8

PING 8.8.8.8 (8.8.8.8): 56 data bytes

64 bytes from 8.8.8.8: icmp_seq=0 ttl=57 time=11.643 ms

64 bytes from 8.8.8.8: icmp_seq=1 ttl=57 time=20.087 ms

New Member

ICMP packet size?

Hi Ajay,

Thank s for the reply.

Yea, that will sum up to exact 74 bytes. Btw, my question where is Ethernet CRC (4 bytes).

lek

ICMP packet size?

I would say you should check some docs on sniffer if you are using. For example wireshark does not capture that field you can make it work but i cant suggest on that.

Thanks
Ajay

Hall of Fame Super Silver

ICMP packet size?

lek

There are several ways of looking at this. One way, which you suggest, is when we look at what is transmitted on the wire for an Ethernet frame there is a CRC which comes at the end. Since the CRC bits are transmitted as part of the frame we should count them in the byte count of the frame.

Another way of looking at it is that since the CRC is used to detect errors in the transmitted frame, and since the CRC is calculated by doing a checksum on the frame, then the CRC can not be part of the frame itself

HTH

Rick

16065
Views
0
Helpful
5
Replies