一、關于wireshark中以太網數據包的最小長度，請看下面的文字：

A physical Ethernet packet will look like this:

As the Ethernet hardware filters the preamble, it is not given to Wireshark or any other application. Most Ethernet interfaces also either don't supply the FCS to Wireshark or other applications, or aren't configured by their driver to do so; therefore, Wireshark will typically only be given the green fields, although on some platforms, with some interfaces, the FCS will be supplied on incoming packets.

Ethernet packets with less than the minimum 64 bytes for an Ethernet packet (header + user data + FCS) are padded to 64 bytes, which means that if there's less than 64-(14+4) = 46 bytes of user data, extra padding data is added to the packet.

【注1】在wireshark中，捕捉到的ARP數據包的長度，很多時候是42bytes，有時候是60bytes。

這個長度取決于發送ARP Request端的操作系統的ARP包編碼方式【是否在ARP數據包末端添加18個0x00的padding】

【注2】有的TCP或UDP數據包的長度也可能小于60bytes。

二、原文網址[原文發布于2014-09-23 22:44]

http://www.CUOXin.com/tom-and-jerry/p/3988109.html

【完結】