0

I am writing an application that needs to ignore frames whose size is smaller than the minimum possible size of Ethernet/IGMP frames. I have researched extensively and found the following information:

  • The minimum size of an Ethernet frame is 64 bytes:

    Header + Payload + FCS (Frame Check Sequence) = 14 + 46 + 4 = 64 bytes

  • If the payload of an Ethernet frame is smaller than 46 bytes, it is padded up to 46 bytes (so that collisions can be detected reliably).

Now, looking at frames in my network using Wireshark, I noticed that most of them have a size of 60 bytes and that some IGMPv2 packets have a size of 46 bytes. These two findings surprised me because:

  1. I expected most frames to have a size of 64 bytes. (After investigating some more, I discovered that Wireshark does not include the 4-byte FCS in the displayed size, which explains why the most frames have a size of 60 bytes).

  2. I did not expect to see a frame with a size smaller than 64 bytes (or 60 bytes if we talk in terms of what Wireshark displays).

So my question relates to the second point, which remains unresolved: Is the format of an IGMP packet different from that of an Ethernet frame? If so, what is the minimum possible size of an IGMP packet?

Improve this question
2
  • What ZAC67 & Ron said plus look at this en.wikipedia.org/wiki/Internet_Group_Management_Protocol Commented Oct 20, 2017 at 20:22
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. Commented Feb 19, 2018 at 20:05

3 Answers 3

Reset to default
1

An Ethernet frame is a layer 2 PDU - as you stated, minimum 64 bytes, maximum 1518 bytes (+4 bytes with 802.1Q tag). The frame has 18 bytes overhead, so it transports a layer 3 payload of 46 to 1500 bytes.

IGMP is IP multicast, living in layer 3. Essentially, it uses a standard IP packet with a multicast destination address. For transport, IP packets are encapsulated in layer 2 frames, for example in Ethernet.

Improve this answer
0
1

If the ethernet payload is short, it's padded.

There's nothing special about IGMP, here's a UDP packet with a 1-byte payload 'x'. You see the IP packet is length 43: this would be transmitted in a minimum-sized ether frame.

Note 60 bytes on wire IP packet of 29 bytes + 14 = 43 The UDP payload is 0x78 at 0x002a, what follows is the padding.

Trimmed output of tshark -Vx. Tshark shows the padding as "trailer", garbage after the IP packet that was sent in this ethernet frame.

Frame 1: 60 bytes on wire (480 bits), 60 bytes captured (480 bits) Ethernet II, Src: 34:02:86:9f:e2:dc (34:02:86:9f:e2:dc), Dst: 90:fb:a6:30:98:3e (90:fb:a6:30:98:3e) Type: IP (0x0800) Trailer: e068ea1810429e75000000000000000000 Internet Protocol Version 4, Src: 192.168.0.28 (192.168.0.28), Dst: 192.168.0.32 (192.168.0.32) Total Length: 29 Protocol: UDP (17) User Datagram Protocol, Src Port: 35219 (35219), Dst Port: 32767 (32767) Length: 9 Data (1 byte) Data: 78 [Length: 1] 0000 90 fb a6 30 98 3e 34 02 86 9f e2 dc 08 00 45 00 ...0.>4.......E. 0010 00 1d ca 5c 40 00 40 11 ee e6 c0 a8 00 1c c0 a8 ...\@.@......... 0020 00 20 89 93 7f ff 00 09 fc bb 78 e0 68 ea 18 10 . ........x.h... 0030 42 9e 75 00 00 00 00 00 00 00 00 00 B.u.........

We see 60 bytes for the exact reason you said: minimum ethernet frame of 64 bytes with the 4-byte FCS removed.

Jonathan.

Improve this answer
0

Don't confuse the network layers. An ethernet frame is a layer-2 frame, and IGMP is a protocol that has messages that are the payload of a layer-3 IPv4 packet, that is in turn the payload of an ethernet frame.

Improve this answer

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.