I am very new to this subject. If i have a data packet that is 75 bytes long, the frame layer tells me that the size of the packet is 75 bytes, the size of the ethernet frame layer is 14 bytes, the IP header is 20 bytes but the IP datagram has length 61. The TCP segment is 21 in length and the TCP header is 20 bytes in length.

I am trying to figure of where the actual file data is. According to my textbook question, there is 21 byes of file data. If i remove the TCP/IP headers i am left with 22 bytes. Is the extra byte for the port number? leaving 21 byes of file data, this data is all stored in the IP datagram.

I then have to explain why?

There seems to be no information on this in the textbook i have, if i am in the wrong place to be asking this question could someone kindly point me in the correct direction.

  • I don't see where the extra byte came from.
    – Ron Trunk
    Jul 18, 2015 at 14:29
  • You really need to get Wireshark and do a packet capture of browsing to an HTTP (not HTTPS) website. That will GREATLY enhance your understanding of this. I already "knew" where it would be before I'd started working with packet captures, but afterwards I really KNEW where it would be.
    – Smithers
    Jul 21, 2015 at 16:56
  • Every site i visit seems to be https :/
    – user16675
    Jul 21, 2015 at 20:32

1 Answer 1


The IP datagram size includes the header, but the TCP segment size does not. The port numbers are contained within the TCP header


   75 Frame size
  - 14 Ethernet
  - 20 IP header
  - 20 TCP header

leaves 21 bytes of data.

EDIT: Perhaps I should be more precise and say "payload" instead of data. In fact, each layer's PDU is "data" to the layer below it.

  • Just a side note, this only works if you don't consider the 4 byte FCS as part of the frame. Otherwise frame size would be 79 bytes.
    – YLearn
    Jul 18, 2015 at 15:46
  • Where is the file data among the layers? and why is it there and not in another layer? Thanks for the answer though +1. If this information is clear or obvious could you recommend a source. Thanks again :)
    – user16675
    Jul 18, 2015 at 17:25
  • The file data is contained in the protocol used to send it, e.g., FTP, HTML, etc. Don't forget, the OSI model is just a model, and nothing follows it exactly.
    – Ron Trunk
    Jul 18, 2015 at 18:11
  • @YLearn, very few people have the hardware necessary to capture "the full frame"(tm). The NIC doesn't expose the FCS to anything; if the FCS is wrong, frame is dumped and only an error counter ticks up, the OS isn't made aware of a packet. (some rare chips do have registers to pass on errored frames.)
    – Ricky
    Jul 18, 2015 at 22:24
  • @Ricky, I completely agree, however I don't think that is justification for text books to disregard the trailer in the total frame size. It at least deserves a footnote IMHO.
    – YLearn
    Jul 20, 2015 at 21:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.