Size of ARP reply frame (42 bytes instead of 60 bytes) ?????

[Eric Gamess]

Hello,

I am monitoring ARP request and ARP reply frames with tcpdump.
tcpdump -n -x -e arp

When I have a ARP request, tcpdump say that the frame size in 60 bytes.
It is OK for me:
6 -> MAC destination address
6 -> MAC source address
2 -> Frame type (0x0806)
28 -> ARP request
18 -> Padding
---------------
60 -> Total bytes

When I have a ARP reply, tcpdump say that the frame size in 42 bytes?????
From what is understand, Ethernet frame should be at least 60 bytes long.
So, what happen with the 18 padding bytes?

Another question: Is there a way to see the CRC (the last 4 bytes)
of the Ethernet frame using tcpdump?

Thank you very much for your help.

Eric.

[p***@klos.com]

Post by Eric Gamess
Hello,
I am monitoring ARP request and ARP reply frames with tcpdump.
tcpdump -n -x -e arp
When I have a ARP request, tcpdump say that the frame size in 60 bytes.
6 -> MAC destination address
6 -> MAC source address
2 -> Frame type (0x0806)
28 -> ARP request
18 -> Padding
---------------
60 -> Total bytes
When I have a ARP reply, tcpdump say that the frame size in 42 bytes?????
From what is understand, Ethernet frame should be at least 60 bytes long.
So, what happen with the 18 padding bytes?

I'll bet the ARP reply is FROM the machine you're running tcpdump on, isn't
it? When tcpdump receives packets from it's own machine, those packets don't
necessarily need to be padded since they haven't been on the wire (yet).

Post by Eric Gamess
Another question: Is there a way to see the CRC (the last 4 bytes)
of the Ethernet frame using tcpdump?

Not that I'm aware of.

========= For LAN/WAN Protocol Analysis, check out PacketView Pro! =========
Patrick Klos Email: ***@klos.com
Klos Technologies, Inc. Web: http://www.klos.com/
==================== You can't win if you don't play! ======================