Ping frame

10 pts.
Tags:
Ethereal
Ping
ping frame
ping size
I've got a question: Im using Ethereal to see my network activity and to try it, I ping from one computer to another one. My ping data size is 2000 bytes but I see that the frames containing the ping request and reply have only 562 bytes. Why is that? Ethereal shows this: Frame 13 (562 bytes on wire, 562 bytes captured) Ethernet II, Src: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59), Dst: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2) Destination: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2) Source: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59) Type: IP (0x0800) Internet Protocol, Src: 10.24.4.13 (10.24.4.13), Dst: 10.24.4.16 (10.24.4.16) Internet Control Message Protocol Type: 8 (Echo (ping) request) Code: 0 Checksum: 0xb577 [correct] Identifier: 0x0200 Sequence number: 0xc400 Data (2000 bytes) Frame (562 bytes): Frame 14 (1514 bytes on wire, 1514 bytes captured) Ethernet II, Src: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2), Dst: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59) Destination: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59) Source: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2) Type: IP (0x0800) Internet Protocol, Src: 10.24.4.16 (10.24.4.16), Dst: 10.24.4.13 (10.24.4.13) Data (1480 bytes) Frame 15 (562 bytes on wire, 562 bytes captured) Ethernet II, Src: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2), Dst: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59) Destination: RealtekS_a5:9e:59 (00:e0:4c:a5:9e:59) Source: RealtekS_a3:41:b2 (00:e0:4c:a3:41:b2) Type: IP (0x0800) Internet Protocol, Src: 10.24.4.16 (10.24.4.16), Dst: 10.24.4.13 (10.24.4.13) Internet Control Message Protocol Type: 0 (Echo (ping) reply) Code: 0 Checksum: 0xbd77 [correct] Identifier: 0x0200 Sequence number: 0xc400 Data (2000 bytes) Frame (562 bytes): Thanks in advance!

Answer Wiki

Thanks. We'll let you know when a new response is added.

This is indeed interesting. I get the same results in Wireshark 1.0.5. I would suggest posting something to the Wireshark mailing list. If you look at the content of the return packets, they actually have 2000 bytes of data but the decode window shows only 562 as the packet size.

Also remember that most networks cannot handle above 1514 byte packets across a WAN. This means the content of the packet not including IP headers is about 1460 bytes.

Discuss This Question: 2  Replies

 
There was an error processing your information. Please try again later.
Thanks. We'll let you know when a new response is added.
Send me notifications when members answer or reply to this question.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy
  • petkoa
    Hi, Nothing wrong with your frames - link MTU (maximum transmission unit) is usually set to 1500 bytes for the Ethernet links. So, larger packet have to be fragmented accordingly. Your frames 14 (1514 B) and 15 (562 B) in fact correspond to a fragmented single 2000 bytes ICMP ping packet (2000 payload + n overhead...). BR, Petko
    3,120 pointsBadges:
    report
  • Pogasu
    I was doing the capture on the machine sending the packet. The packet decode shows that the data section is 2000 bytes - yet the frame size shows the 562 bytes. This is before the packet ever hits the wire. I hear what you are saying about fragmentation, but the decode on the sending station does not really show this. You would need to capture the packets between the 2 hosts to see the fragmentation actually happening.
    0 pointsBadges:
    report

Forgot Password

No problem! Submit your e-mail address below. We'll send you an e-mail containing your password.

Your password has been sent to:

To follow this tag...

There was an error processing your information. Please try again later.

REGISTER or login:

Forgot Password?
By submitting you agree to receive email from TechTarget and its partners. If you reside outside of the United States, you consent to having your personal data transferred to and processed in the United States. Privacy

Thanks! We'll email you when relevant content is added and updated.

Following