This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am working with software that includes the Ethernet Header size (14 bytes) in the IPv4 Total Length value. I have read the IP RFC 791 and it should not be part of the IP Total Length, but I noticed that Wireshark is not upset with the message.

Does anyone know why?

asked 10 Mar '15, 09:12

blogzit's gravatar image

blogzit
6112
accept rate: 0%

Not only should the Ethernet header not be included in the IP Total Length, but the entire frame should be 18 bytes larger than the IP packet, not 14. Many systems strip off the Frame Check Sequence before Wireshark sees the packet, so we only see 14 bytes of Ethernet overhead, but the entire frame as transmitted on the wire is 18 bytes larger than the IP portion if both the Ethernet header and trailer are included.

Can you possibly upload some packets illustrating this, if they don't include confidential information? You can upload to https://appliance.cloudshark.org/ and then post the link here.

And the obvious conclusion about why Wireshark is not upset would be that Wireshark is simply displaying the Total Length field, but not doing error checking on that field.

(10 Mar '15, 09:58) Jim Aragon

Thank you for answering my question. Unfortunately the packet are proprietary.

(10 Mar '15, 11:50) blogzit

then it's obviously hard to help you.

but I noticed that Wireshark is not upset with the message.

what does that mean?

(11 Mar '15, 03:31) Kurt Knochner ♦
Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×178
×87
×29

question asked: 10 Mar '15, 09:12

question was seen: 4,375 times

last updated: 11 Mar '15, 03:35

p​o​w​e​r​e​d by O​S​Q​A