Maximum and minimum Ethernet frames, MTU

Article Source: http://ewangsoft.blog.163.com/blog/static/7721558220093200840864/

According to rfc894, the maximum length of the IP packet encapsulated by Ethernet is 1500 bytes. That is to say, the maximum length of the Ethernet frame should be the Ethernet header plus 1500, add a 7-byte leading synchronization code and a 1-byte frame start delimiter, specifically: 7-byte leading synchronization code + 1-byte frame start delimiter + 6-byte destination MAC + 6-byte source MAC + 2-byte Frame Type + 1500 + 4-byte FCS.

According to the above, the maximum frame should be 1526 bytes, but the maximum frame we get from Packet Capturing is 1514 bytes. Why not 1526 bytes?

The reason is that when the data frame reaches the network cardPhysical LayerThe network adapter must first remove the leading synchronization code and the starting delimiters of the frame, and then perform CRC checks on the frame. If the frame verification and error occur, the frame will be discarded. If the checksum is correct, check whether the target hardware address of the frame meets your receiving conditions (the destination address is your own physical hardware address, broadcast address, and the available multicast hardware address ), if yes, the frame will be handed over to"Device Driver"For further processing. At this time, the software we capture can capture data. Therefore, what we capture is to remove the leading synchronization code, the frame start delimiter, and data outside of the FCS. The maximum value is 6.
+ 6 + 2 + 1500 = 1514.

According to Ethernet rules, the minimum part of the Ethernet frame data domain is 46 bytes, that is, the minimum value of the Ethernet frame is 6 + 6 + 2 + 46 + 4 = 64. Except for the 4-byte FCS, the packet capture time is 60 bytes. When the length of a data field is less than 46 bytes, the MAC Sub-layer will fill the data field to ensure that the data frame length is not less than 64 bytes. The MAC Sub-layer is responsible for filling data, that is, the device driver. Different Packet Capture programs and device drivers may have different priority levels, and the packet capture program may have a higher priority than the device driver, that is,Our package capture program may have captured data before the device driver has not filled 64-byte frames.. Therefore, the size of data frames captured by different packet capture tools may be different. (For example, Wireshark may not populate the data segment, while sniffer may capture the data segment.)

How to view Network Interface MTU:

In Windows, enter netstat-E-V at the command prompt.

Enter netstat-I under FreeBSD