Path: utzoo!utgpu!news-server.csri.toronto.edu!cs.utexas.edu!swrinde!zaphod.mps.ohio-state.edu!tut.cis.ohio-state.edu!ucbvax!ASYLUM.SF.CA.US!romkey
From: romkey@ASYLUM.SF.CA.US (John Romkey)
Newsgroups: comp.protocols.tcp-ip
Subject: Packet Sizes
Message-ID: <9103151236.AA05472@asylum.sf.ca.us>
Date: 15 Mar 91 20:36:04 GMT
References: <7741@uceng.UC.EDU>
Sender: daemon@ucbvax.BERKELEY.EDU
Reply-To: romkey@asylum.sf.ca.us
Organization: The Internet
Lines: 18

You don't mention the type of network you're using; I presume it's
ethernet.

If you're looking at raw ethernet packet lengths (as opposed to IP
datagram lengths), you'll see lots of 60 byte packets on the net
because ethernet has a minimum packet length of 60 bytes. Any packets
that are shorter are padded out to 60. IP can tell how many bytes it
should pay attention to because it has its own length field. IEEE
framing over ethernet uses the type field as a length field for a
similar reason.

All ARP packets should be under 60 bytes. Many TCP/IP packets fall in
here, too: acknowledgements, packets with little data (for instance,
packets initiated by a telnet client will almost always be 14 bytes
of ethernet header + 20 bytes of IP + 20 bytes of TCP + 1 or 2 bytes
of data = roughly 55 bytes long).
		- john romkey			Epilogue Technology
USENET/UUCP/Internet:  romkey@asylum.sf.ca.us	voice/fax: 415 594-1141