一、關(guān)于wireshark中以太網(wǎng)數(shù)據(jù)包的最小長(zhǎng)度，請(qǐng)看下面的文字：
Packet format
A physical Ethernet packet will look like this:
|
Preamble |
Destination MAC address |
Source MAC address |
Type/Length |
User Data |
Frame Check Sequence (FCS) |
|
8 |
6 |
6 |
2 |
46 - 1500 |
4 |
As the Ethernet hardware filters the preamble, it is not given to Wireshark or any other application. Most Ethernet interfaces also either don't supply the FCS to Wireshark or other applications, or aren't configured by their driver to do so; therefore, Wireshark will typically only be given the green fields, although on some platforms, with some interfaces, the FCS will be supplied on incoming packets.
Allowed Packet Lengths
Ethernet packets with less than the minimum 64 bytes for an Ethernet packet (header + user data + FCS) are padded to 64 bytes, which means that if there's less than 64-(14+4) = 46 bytes of user data, extra padding data is added to the packet.
?【注1】在wireshark中，捕捉到的ARP數(shù)據(jù)包的長(zhǎng)度，很多時(shí)候是42bytes，有時(shí)候是60bytes。
這個(gè)長(zhǎng)度取決于發(fā)送ARP Request端的操作系統(tǒng)的ARP包編碼方式【是否在ARP數(shù)據(jù)包末端添加18個(gè)0x00的padding】
【注2】有的TCP或UDP數(shù)據(jù)包的長(zhǎng)度也可能小于60bytes。
??
二、原文網(wǎng)址[原文發(fā)布于2014-09-23 22:44]
http://www.cnblogs.com/tom-and-jerry/p/3988109.html
?
【完結(jié)】
[RK_2014_0923]wireshark捕捉到的Ethernet II數(shù)據(jù)包的最小長(zhǎng)度為60
更多文章、技術(shù)交流、商務(wù)合作、聯(lián)系博主
微信掃碼或搜索：z360901061
微信掃一掃加我為好友
QQ號(hào)聯(lián)系： 360901061
您的支持是博主寫作最大的動(dòng)力，如果您喜歡我的文章，感覺(jué)我的文章對(duì)您有幫助，請(qǐng)用微信掃描下面二維碼支持博主2元、5元、10元、20元等您想捐的金額吧，狠狠點(diǎn)擊下面給點(diǎn)支持吧，站長(zhǎng)非常感激您！手機(jī)微信長(zhǎng)按不能支付解決辦法：請(qǐng)將微信支付二維碼保存到相冊(cè)，切換到微信，然后點(diǎn)擊微信右上角掃一掃功能，選擇支付二維碼完成支付。
【本文對(duì)您有幫助就好】元
