Minimum possible size of Ethernet/IGMP frames

Question

I am writing an application that needs to ignore frames whose size is smaller than the minimum possible size of Ethernet/IGMP frames. I have researched extensively and found the following information:

• The minimum size of an Ethernet frame is 64 bytes:

  Header + Payload + FCS (Frame Check Sequence) = 14 + 46 + 4 = 64 bytes

• If the payload of an Ethernet frame is smaller than 46 bytes, it is padded up to 46 bytes (so that collisions can be detected reliably).

Now, looking at frames in my network using Wireshark, I noticed that most of them have a size of 60 bytes and that some IGMPv2 packets have a size of 46 bytes. These two findings surprised me because:

1. I expected most frames to have a size of 64 bytes. (After investigating some more, I discovered that Wireshark does not include the 4-byte FCS in the displayed size, which explains why the most frames have a size of 60 bytes).

2. I did not expect to see a frame with a size smaller than 64 bytes (or 60 bytes if we talk in terms of what Wireshark displays).

So my question relates to the second point, which remains unresolved: Is the format of an IGMP packet different from that of an Ethernet frame? If so, what is the minimum possible size of an IGMP packet?

Answer 1

An Ethernet frame is a layer 2 PDU - as you stated, minimum 64 bytes, maximum 1518 bytes (+4 bytes with 802.1Q tag). The frame has 18 bytes overhead, so it transports a layer 3 payload of 46 to 1500 bytes.

IGMP is IP multicast, living in layer 3. Essentially, it uses a standard IP packet with a multicast destination address. For transport, IP packets are encapsulated in layer 2 frames, for example in Ethernet.

Answer 2

If the ethernet payload is short, it's padded.

There's nothing special about IGMP, here's a UDP packet with a 1-byte payload 'x'. You see the IP packet is length 43: this would be transmitted in a minimum-sized ether frame.

Note 60 bytes on wire IP packet of 29 bytes + 14 = 43 The UDP payload is 0x78 at 0x002a, what follows is the padding.

Trimmed output of tshark -Vx. Tshark shows the padding as "trailer", garbage after the IP packet that was sent in this ethernet frame.

Frame 1: 60 bytes on wire (480 bits), 60 bytes captured (480 bits)
Ethernet II, Src: 34:02:86:9f:e2:dc (34:02:86:9f:e2:dc), Dst: 90:fb:a6:30:98:3e (90:fb:a6:30:98:3e)
    Type: IP (0x0800)
    Trailer: e068ea1810429e75000000000000000000
Internet Protocol Version 4, Src: 192.168.0.28 (192.168.0.28), Dst: 192.168.0.32 (192.168.0.32)
    Total Length: 29
    Protocol: UDP (17)
User Datagram Protocol, Src Port: 35219 (35219), Dst Port: 32767 (32767)
    Length: 9
Data (1 byte)
    Data: 78
    [Length: 1]

0000  90 fb a6 30 98 3e 34 02 86 9f e2 dc 08 00 45 00   ...0.>4.......E.
0010  00 1d ca 5c 40 00 40 11 ee e6 c0 a8 00 1c c0 a8   ...\@.@.........
0020  00 20 89 93 7f ff 00 09 fc bb 78 e0 68 ea 18 10   . ........x.h...
0030  42 9e 75 00 00 00 00 00 00 00 00 00               B.u.........

We see 60 bytes for the exact reason you said: minimum ethernet frame of 64 bytes with the 4-byte FCS removed.

Jonathan.

Answer 3

Don't confuse the network layers. An ethernet frame is a layer-2 frame, and IGMP is a protocol that has messages that are the payload of a layer-3 IPv4 packet, that is in turn the payload of an ethernet frame.