一、關于wireshark中以太網數據包的最小長度，請看下面的文字：
Packet format
A physical Ethernet packet will look like this:
|
Preamble |
Destination MAC address |
Source MAC address |
Type/Length |
User Data |
Frame Check Sequence (FCS) |
|
8 |
6 |
6 |
2 |
46 - 1500 |
4 |
As the Ethernet hardware filters the preamble, it is not given to Wireshark or any other application. Most Ethernet interfaces also either don't supply the FCS to Wireshark or other applications, or aren't configured by their driver to do so; therefore, Wireshark will typically only be given the green fields, although on some platforms, with some interfaces, the FCS will be supplied on incoming packets.
Allowed Packet Lengths
Ethernet packets with less than the minimum 64 bytes for an Ethernet packet (header + user data + FCS) are padded to 64 bytes, which means that if there's less than 64-(14+4) = 46 bytes of user data, extra padding data is added to the packet.
?【注1】在wireshark中，捕捉到的ARP數據包的長度，很多時候是42bytes，有時候是60bytes。
這個長度取決于發送ARP Request端的操作系統的ARP包編碼方式【是否在ARP數據包末端添加18個0x00的padding】
【注2】有的TCP或UDP數據包的長度也可能小于60bytes。
??
二、原文網址[原文發布于2014-09-23 22:44]
http://www.cnblogs.com/tom-and-jerry/p/3988109.html
?
【完結】
更多文章、技術交流、商務合作、聯系博主
微信掃碼或搜索：z360901061
微信掃一掃加我為好友
QQ號聯系： 360901061
您的支持是博主寫作最大的動力，如果您喜歡我的文章，感覺我的文章對您有幫助，請用微信掃描下面二維碼支持博主2元、5元、10元、20元等您想捐的金額吧，狠狠點擊下面給點支持吧，站長非常感激您！手機微信長按不能支付解決辦法：請將微信支付二維碼保存到相冊，切換到微信，然后點擊微信右上角掃一掃功能，選擇支付二維碼完成支付。
【本文對您有幫助就好】元
