3

What does Trailer field stand for in Ethernet II frame? Can you explain this on following cases (length of ARP packet is 28 bytes)?

Case #1:

Ethernet II
Destination: Broadcast (ff:ff:ff:ff:ff:ff)
Source: c4:46:19:1d:05:f6 (c4:46:19:1d:05:f6)
Type: ARP (0x0806)
Trailer: D01CCF9087084E0A00000000000000000000

Address Resolution Protocol (reply)
Hardware type: Ethernet (0x0001)
Protocol type: IP (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: reply (0x0002)
[Is gratuitous: False]
Sender MAC address: c4:46:19:1d:05:f6
Sender IP address: 88.200.89.1
Target MAC address: ff:ff:ff:ff:ff:ff
Target IP address: 0.0.0.0

Case #2:

Ethernet II
Destination: Broadcast (ff:ff:ff:ff:ff:ff)
Source: Cisco_f6:16:c7 (00:16:9d:f6:16:c7)
Type: ARP (0x0806)
Trailer: 000000000000000000000000000000000000

[Duplicate IP address detected for 88.200.89.1]

Address Resolution Protocol (reply/gratuitous)
Hardware type: Ethernet (0x0001)
Protocol type: IP (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: reply (0x0002)
[Is gratuitous: True]
Sender MAC address: Cisco_f6:16:c7
Sender IP address: 88.200.89.1
Target MAC address: Cisco_f6:16:c7
Target IP address: 88.200.89.1

Thank you!

1
  • Just to remind that if you want more detailed information, you can refer to this post on askWireshark.
    – Faraway
    Dec 21, 2023 at 14:32

1 Answer 1

4

Ethernet imposes a 60-byte (64-byte, if you include the CRC at the end of the packet) minimum on packet sizes (a requirement imposed by the CSMA/CD mechanism used in Ethernet). The trailer is the padding added to short packets to satisfy that requirement.

Wireshark infers the length of the trailer from what information is available in the packet. In packets in which the type/length field in the Ethernet header is a length field, the length field can be used to determine the length of the trailer; however, in packets in which it's a type field, the length has to be indicated by something in the payload, so that the implementation of the protocol running on top of Ethernet knows what's data and what's padding - for example, IPv4 and IPv6 have fields in the header from which the total length of the IP datagram can be determined.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.