montjoy@babbage.ece.uc.edu (Robert Montjoy) (03/13/91)
Hi. Can some one give me an idea on packet sizes of various things. I am doing network monitering for the frist time can some tell me what is in a 60 Byte packet(in general)(note our network has 35% 60 byte packets,is that good or bad). Are they mostily broadcasts. How can you tell if you have to many broadcasts. Thanks. Rob Montjoy -- Rob Montjoy - Rob.Montjoy@UC.Edu Computer Engineer - montjoy@ucbeh.BITNET University of Cincinnati - montjoy@babbage.ece.uc.edu Electrical and Computer Enginering - uunet!uceng!rmontjoy
tsudik@pollux.usc.edu (Gene Tsudik) (03/13/91)
If I recall correctly, 60 byte packet are usually generated by TELNET. Gene Tsudik USC
romkey@ASYLUM.SF.CA.US (John Romkey) (03/16/91)
You don't mention the type of network you're using; I presume it's ethernet. If you're looking at raw ethernet packet lengths (as opposed to IP datagram lengths), you'll see lots of 60 byte packets on the net because ethernet has a minimum packet length of 60 bytes. Any packets that are shorter are padded out to 60. IP can tell how many bytes it should pay attention to because it has its own length field. IEEE framing over ethernet uses the type field as a length field for a similar reason. All ARP packets should be under 60 bytes. Many TCP/IP packets fall in here, too: acknowledgements, packets with little data (for instance, packets initiated by a telnet client will almost always be 14 bytes of ethernet header + 20 bytes of IP + 20 bytes of TCP + 1 or 2 bytes of data = roughly 55 bytes long). - john romkey Epilogue Technology USENET/UUCP/Internet: romkey@asylum.sf.ca.us voice/fax: 415 594-1141
jclark@sdcc6.ucsd.edu (John Clark) (03/23/91)
In article <9103151236.AA05472@asylum.sf.ca.us> romkey@asylum.sf.ca.us writes:
+If you're looking at raw ethernet packet lengths (as opposed to IP
+datagram lengths), you'll see lots of 60 byte packets on the net
+because ethernet has a minimum packet length of 60 bytes. Any packets
+that are shorter are padded out to 60. IP can tell how many bytes it
Sometime ago I had a ethernet analyzer on a line with both TCP/IP
and DECNET traffic. It seems to me that there were some DECNET
packets shorter than the minimum. It could have been a halucination
or does DEC violate the standard.
--
John Clark
jclark@ucsd.edumarc@dumbcat.sf.ca.us (Marco S Hyman) (03/24/91)
In article <17724@sdcc6.ucsd.edu> jclark@sdcc6.ucsd.edu (John Clark) writes: In article <9103151236.AA05472@asylum.sf.ca.us> romkey@asylum.sf.ca.us writes: +If you're looking at raw ethernet packet lengths (as opposed to IP +datagram lengths), you'll see lots of 60 byte packets on the net +because ethernet has a minimum packet length of 60 bytes. Any packets +that are shorter are padded out to 60. IP can tell how many bytes it Sometime ago I had a ethernet analyzer on a line with both TCP/IP and DECNET traffic. It seems to me that there were some DECNET packets shorter than the minimum. It could have been a halucination or does DEC violate the standard. Unlikely. And it depends upon what you're measuring. A standard (D-I-X) ethernet frame consists of: 6 octets of destination 6 octets of source 2 octets of type 46-1500 octets of data 4 octets of CRC The minimum frame size is 64 octets (plus 64 bits of preamble and 9.6 us of interframe spacing). It is possible you were using a "smart" analyzer that knows the protocol formats well enough to not display fill characters used to force the frame to the proper minimum size. -- // marc // home: marc@dumbcat.sf.ca.us {decwrl,sun}!pacbell!dumbcat!marc // work: marc@ascend.com uunet!aria!marc
fortinp@bwdls56.Berkeley.EDU (Pierre Fortin) (03/26/91)
In article <271@dumbcat.sf.ca.us>, marc@dumbcat.sf.ca.us (Marco S Hyman) writes: |>In article <17724@sdcc6.ucsd.edu> jclark@sdcc6.ucsd.edu (John Clark) writes: |> In article <9103151236.AA05472@asylum.sf.ca.us> romkey@asylum.sf.ca.us writes: |> +If you're looking at raw ethernet packet lengths (as opposed to IP |> +datagram lengths), you'll see lots of 60 byte packets on the net |> +because ethernet has a minimum packet length of 60 bytes. Any packets |> +that are shorter are padded out to 60. IP can tell how many bytes it |> |> Sometime ago I had a ethernet analyzer on a line with both TCP/IP |> and DECNET traffic. It seems to me that there were some DECNET |> packets shorter than the minimum. It could have been a halucination |> or does DEC violate the standard. |> |>Unlikely. And it depends upon what you're measuring. A standard (D-I-X) |>ethernet frame consists of: |> |> 6 octets of destination |> 6 octets of source |> 2 octets of type |> 46-1500 octets of data |> 4 octets of CRC |> |>The minimum frame size is 64 octets (plus 64 bits of preamble and 9.6 us of |>interframe spacing). It is possible you were using a "smart" analyzer that |>knows the protocol formats well enough to not display fill characters used to |>force the frame to the proper minimum size. Actually, I've seen the same thing in the past (haven't looked at a trace for some time now :) I may be wrong, but I think these short packets are coming from bridges on the network; I was once told that these are part of the spanning-tree stuff... Maybe someone else can add more... |>-- |>// marc |>// home: marc@dumbcat.sf.ca.us {decwrl,sun}!pacbell!dumbcat!marc |>// work: marc@ascend.com uunet!aria!marc Cheers, Pierre Fortin fortinp@bnr.ca (613)763-2598
art@opal.acc.com (Art Berggreen) (03/29/91)
In article <17724@sdcc6.ucsd.edu> jclark@sdcc6.ucsd.edu (John Clark) writes: >In article <9103151236.AA05472@asylum.sf.ca.us> romkey@asylum.sf.ca.us writes: >+If you're looking at raw ethernet packet lengths (as opposed to IP >+datagram lengths), you'll see lots of 60 byte packets on the net >+because ethernet has a minimum packet length of 60 bytes. Any packets >+that are shorter are padded out to 60. IP can tell how many bytes it > >Sometime ago I had a ethernet analyzer on a line with both TCP/IP >and DECNET traffic. It seems to me that there were some DECNET >packets shorter than the minimum. It could have been a halucination >or does DEC violate the standard. >-- > >John Clark >jclark@ucsd.edu Is it possible that your ethernet analyzer was reporting the length of the DECNET packet? DECNET uses a length field immediately after the Ethertype to define the size of the encapsulated DECNET packet. The Ethernet packet is always supposed to be padded out to minimum size (if neccessary). Art
willis@cs.tamu.edu (Willis Marti) (03/29/91)
.In article <17724@sdcc6.ucsd.edu> jclark@sdcc6.ucsd.edu (John Clark) writes: .>In article <9103151236.AA05472@asylum.sf.ca.us> romkey@asylum.sf.ca.us writes: .>+If you're looking at raw ethernet packet lengths (as opposed to IP .>+datagram lengths), you'll see lots of 60 byte packets on the net .>+because ethernet has a minimum packet length of 60 bytes. Any packets .>+that are shorter are padded out to 60. IP can tell how many bytes it .> .>Sometime ago I had a ethernet analyzer on a line with both TCP/IP .>and DECNET traffic. It seems to me that there were some DECNET .>packets shorter than the minimum. It could have been a halucination .>or does DEC violate the standard. .>-- .> .>John Clark .>jclark@ucsd.edu . .Is it possible that your ethernet analyzer was reporting the length of the .DECNET packet? DECNET uses a length field immediately after the Ethertype .to define the size of the encapsulated DECNET packet. The Ethernet packet .is always supposed to be padded out to minimum size (if neccessary). . .Art To clarify, things, the minimum ethernet frame is 64 octets -- which translates into 6 bytes dest., 6 bytes src, 2 bytes (type/length), 4 btyes frame check sequence & 56 bytes data+pad. Preamble and SFD excluded. And, yes, DEC does violate this minimum length (in loopback packets). ------------------------------------------------------------------------------- Willis F. Marti Internet: willis@cs.tamu.edu Director, Computer Services Group, Dept of Computer Science, Texas A&M Univ. ---Not an official document of Texas A&M---