[Winpcap-users] Ethernet Trailer

[Gerald Combs]

ceo wrote:
 >
 >     I sniff with Ethereal and find from time to time an "Ethernet
 >     Trailer" of a
 >     few bytes.
 >     What porpose does it serve?
 >      How does the sniffer software discovers that?
 >     Can someone indicate some reference in the Internet on that?

The minimum length of an Ethernet frame (header + payload + FCS) is 64 
bytes.  In shared topologies this helps collision detection and makes 
sure the packet spans the length of the cable you're using (which was 
probably a bigger deal when Ethernet primarily ran over coax cable, 
horse hair, and asbestos).

The presence of a trailer can be determined by comparing the payload 
length to the length of the packet sent on the wire.  This can get a 
little tricky since some NICs and/or drivers strip off the FCS.

The Ethernet pages on Wikipedia and the Wireshark wiki provide pretty 
good introductory material.  Far more than you ever wanted to know about 
Ethernet can be found in IEEE 802.3: 
http://standards.ieee.org/getieee802/802.3.html