Sign Up to our social questions and Answers Engine to ask questions, answer people’s questions, and connect with other people.
Login to our social questions & Answers Engine to ask questions answer people’s questions & connect with other people.
Lost your password? Please enter your email address. You will receive a link and will create a new password via email.
Please briefly explain why you feel this question should be reported.
Please briefly explain why you feel this answer should be reported.
Please briefly explain why you feel this user should be reported.
I have a simple c++ code that build SYN packet and send it by raw socket.
I allocate 54 bytes for this (Ethernet 14 bytes ).
Wireshark on the sender show 54 bytes, but on the receiver wiresark show 60 bytes . 6 bytes are added as a trailer to the end of the packet.
The same happen if i send the packet with scapy. (54 on sender, 60 on receiver)
Can you please advice?
Ethernet can’t send frames that are shorter than 64 bytes, where 60 bytes is payload and 4 bytes is a checksum (the FCS). The FCS gets stripped out by the hardware and is never seen by software. That’s why the application will only see 60 bytes.
So the extra bytes you see added get added on by the hardware and there’s nothing you can do about it. The trailer should be all zeros though.
Wireshark has good information about this on their wiki: http://wiki.wireshark.org/Ethernet