Newsgroups: comp.protocols.tcp-ip
Path: utzoo!utgpu!cunews!bnrgate!bwdls61!bwdls56!fortinp
From: fortinp@bwdls56.Berkeley.EDU (Pierre Fortin)
Subject: Re: Packet Sizes
Message-ID: <1991Mar25.230124.29667@bwdls61.bnr.ca>
Sender: usenet@bwdls61.bnr.ca (Use Net)
Reply-To: fortinp@bwdls56.Berkeley.EDU (Pierre Fortin)
Organization: Bell-Northern Research, Ottawa, Canada
References: <7741@uceng.UC.EDU> <9103151236.AA05472@asylum.sf.ca.us> <271@dumbcat.sf.ca.us>
Date: Mon, 25 Mar 1991 23:01:24 GMT

In article <271@dumbcat.sf.ca.us>, marc@dumbcat.sf.ca.us (Marco S Hyman)
writes:
|>In article <17724@sdcc6.ucsd.edu> jclark@sdcc6.ucsd.edu (John Clark) writes:
|>    In article <9103151236.AA05472@asylum.sf.ca.us>
romkey@asylum.sf.ca.us writes:
|>    +If you're looking at raw ethernet packet lengths (as opposed to IP
|>    +datagram lengths), you'll see lots of 60 byte packets on the net
|>    +because ethernet has a minimum packet length of 60 bytes. Any packets
|>    +that are shorter are padded out to 60. IP can tell how many bytes it
|>    
|>    Sometime ago I had a ethernet analyzer on a line with both TCP/IP
|>    and DECNET traffic. It seems to me that there were some DECNET
|>    packets shorter than the minimum. It could have been a halucination
|>    or does DEC violate the standard.
|>
|>Unlikely.  And it depends upon what you're measuring.  A standard (D-I-X)
|>ethernet frame consists of:
|>
|>	6 octets of destination
|>	6 octets of source
|>	2 octets of type
|>	46-1500 octets of data
|>	4 octets of CRC
|>
|>The minimum frame size is 64 octets (plus 64 bits of preamble and 9.6 us of
|>interframe spacing). It is possible you were using a "smart" analyzer that
|>knows the protocol formats well enough to not display fill characters used to
|>force the frame to the proper minimum size.

Actually, I've seen the same thing in the past (haven't looked at a
trace for some
time now :)   I may be wrong, but I think these short packets are coming from 
bridges on the network; I was once told that these are part of the
spanning-tree 
stuff...  Maybe someone else can add more...

|>-- 
|>// marc
|>// home: marc@dumbcat.sf.ca.us		{decwrl,sun}!pacbell!dumbcat!marc
|>// work: marc@ascend.com		uunet!aria!marc
                             
Cheers,                      
Pierre Fortin       fortinp@bnr.ca         (613)763-2598