I am very new to this subject. If i have a data packet that is 75 bytes long, the frame layer tells me that the size of the packet is 75 bytes, the size of the ethernet frame layer is 14 bytes, the IP header is 20 bytes but the IP datagram has length 61. The TCP segment is 21 in length and the TCP header is 20 bytes in length.

I am trying to figure of where the actual file data is. According to my textbook question, there is 21 byes of file data. If i remove the TCP/IP headers i am left with 22 bytes. Is the extra byte for the port number? leaving 21 byes of file data, this data is all stored in the IP datagram.

I then have to explain why?

There seems to be no information on this in the textbook i have, if i am in the wrong place to be asking this question could someone kindly point me in the correct direction.

  • I don't see where the extra byte came from. – Ron Trunk Jul 18 '15 at 14:29
  • You really need to get Wireshark and do a packet capture of browsing to an HTTP (not HTTPS) website. That will GREATLY enhance your understanding of this. I already "knew" where it would be before I'd started working with packet captures, but afterwards I really KNEW where it would be. – Smithers Jul 21 '15 at 16:56
  • Every site i visit seems to be https :/ – user16675 Jul 21 '15 at 20:32

The IP datagram size includes the header, but the TCP segment size does not. The port numbers are contained within the TCP header


   75 Frame size
  - 14 Ethernet
  - 20 IP header
  - 20 TCP header

leaves 21 bytes of data.

EDIT: Perhaps I should be more precise and say "payload" instead of data. In fact, each layer's PDU is "data" to the layer below it.

  • Just a side note, this only works if you don't consider the 4 byte FCS as part of the frame. Otherwise frame size would be 79 bytes. – YLearn Jul 18 '15 at 15:46
  • Where is the file data among the layers? and why is it there and not in another layer? Thanks for the answer though +1. If this information is clear or obvious could you recommend a source. Thanks again :) – user16675 Jul 18 '15 at 17:25
  • The file data is contained in the protocol used to send it, e.g., FTP, HTML, etc. Don't forget, the OSI model is just a model, and nothing follows it exactly. – Ron Trunk Jul 18 '15 at 18:11
  • @YLearn, very few people have the hardware necessary to capture "the full frame"(tm). The NIC doesn't expose the FCS to anything; if the FCS is wrong, frame is dumped and only an error counter ticks up, the OS isn't made aware of a packet. (some rare chips do have registers to pass on errored frames.) – Ricky Jul 18 '15 at 22:24
  • @Ricky, I completely agree, however I don't think that is justification for text books to disregard the trailer in the total frame size. It at least deserves a footnote IMHO. – YLearn Jul 20 '15 at 21:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy