I am writing an application that needs to ignore frames whose size is smaller than the minimum possible size of Ethernet/IGMP frames. I have researched extensively and found the following information:
-
The minimum size of an Ethernet frame is 64 bytes:
Header + Payload + FCS (Frame Check Sequence) = 14 + 46 + 4 = 64 bytes
-
If the payload of an Ethernet frame is smaller than 46 bytes, it is padded up to 46 bytes (so that collisions can be detected reliably).
Now, looking at frames in my network using Wireshark, I noticed that most of them have a size of 60 bytes and that some IGMPv2 packets have a size of 46 bytes. These two findings surprised me because:
-
I expected most frames to have a size of 64 bytes. (After investigating some more, I discovered that Wireshark does not include the 4-byte FCS in the displayed size, which explains why the most frames have a size of 60 bytes).
-
I did not expect to see a frame with a size smaller than 64 bytes (or 60 bytes if we talk in terms of what Wireshark displays).
So my question relates to the second point, which remains unresolved: Is the format of an IGMP packet different from that of an Ethernet frame? If so, what is the minimum possible size of an IGMP packet?
Best Answer
An Ethernet frame is a layer 2 PDU - as you stated, minimum 64 bytes, maximum 1518 bytes (+4 bytes with 802.1Q tag). The frame has 18 bytes overhead, so it transports a layer 3 payload of 46 to 1500 bytes.
IGMP is IP multicast, living in layer 3. Essentially, it uses a standard IP packet with a multicast destination address. For transport, IP packets are encapsulated in layer 2 frames, for example in Ethernet.