7

after ARP protocol in a frame, there are many 0 bytes. Does anyone know the reason for the existence of these 0 bytes? enter image description here

1 Answer 1

18

Check the Ethernet II accordion, all the 0 are labelled as padding.

Ethernet requires that all packets be at least 60 bytes long (64 bytes if you include the Frame Check Sequence at the end), so if a packet is less than 60 bytes long (including the 14-byte Ethernet header), additional padding bytes have to be added to the end of the packet.

(Those padding bytes will not show up on packets sent by the machine running Wireshark; the padding is added by the Ethernet hardware, and packets being sent by the machine capturing the traffic are given to the program before being handed to the hardware, so they haven't been padded.)

wireshark explanation

2
  • 2
    Why do all packets need to be 60 bytes long? Mar 2, 2015 at 7:48
  • 2
    From wikipedia: Note d: Minimum payload size is dictated by the 512-bit slot time used for collision detection in the Ethernet LAN architecture. Mar 2, 2015 at 9:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.