1

The Ethernet minimum length should be 64 Bytes, so when the data is less than 46B, there would be some extra bytes padding to the end of data, make sure the frame size up to 64B. When I capture the frames less than 64B by Wireshark, it shows "padding" or sometimes "trailer" , so my question is : what's the difference between trailer and padding field in ethernet frame captured by wireshark?

enter image description here

enter image description here

===================================================================

I used to think that padding and trailer were the same thing, but when I saw them appearing in one frame, I was confused. Just like this ↓ enter image description here

  • 1
    Those are cosmetic difference between different versions of wireshark. Technically, "trailer" would be a layer-2 thing, and padding layer-3, but no one really makes that distinction anymore. – Ricky Beam Apr 26 at 8:21
  • @RickyBeam Trying to standardise the meanings of common networking terms is rather like nailing treacle to the wall. For example, 802.3 uses padding as a layer-2 thing and trailer as a level-1 thing. – richardb Apr 26 at 17:35
  • I used to think that padding and trailer were the same thing, but when I saw them appearing in one frame, I was confused. – Ben May 8 at 6:23
1

Since the ARP packet size is fixed and smaller than a minimum Ethernet payload, padding needs to be used at all times. Wireshark most often doesn't see the FCS that's closing a received frame[1], so it needs to apply some guesswork as to which bytes might be padding. It calls these excess bytes trailer. Padding might show up on sent frames, although these padding bytes aren't usually visible (since they're only added by the NIC/driver).

Basically, it's the same thing - provided Wireshark correctly interprets the frame contents.

[addition for 2nd screenshot]: I'm counting 18 padding bytes which is the exact difference between the ARP packet size (28 bytes) and the minimum Ethernet payload size (46 bytes) - that's padding as required by Ethernet and recognized as such by Wireshark.

The rest is excess data (garbage?) that is trailing the minimum frame, so it's labeled as Trailer. It looks like it starts with the (possibly correct) FCS, followed by some more bytes - potentially metadata misinterpreted by Wireshark, which would also explain the FCS status bad.

You might need to recheck the import options for the dump for Wireshark to make more sense of it.

[1] The real frame end is indicated by the physical layer by just stopping the carrier signal or sending a special symbol (depending on the variant). This isn't visible to the capturing library at any time. The NIC driver just provides a buffer containing bytes, usually also stripped of the FCS.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.