Linux – arp packet received larger than packet sent, why

arplinuxnetworkingping

I'm trying to debug a networking issue. During this process, I've noticed that when I try to do an arping, the received arp packets are larger than sent arp packets, as outputted by tcpdump.

(Note that both ends have a br100 bridge to the eth1 interface).

Command:

# arping 10.40.0.5 -I br100 -c1
ARPING 10.40.0.5 from 10.40.0.1 br100
Sent 1 probes (1 broadcast(s))
Received 0 response(s)

tcpdump (sender):

# tcpdump -nnvvXSs 1514 arp -i eth1
tcpdump: WARNING: eth1: no IPv4 address assigned
tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size 1514 bytes
21:32:29.529106 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 10.40.0.5 (ff:ff:ff:ff:ff:ff) tell 10.40.0.1, length 28
    0x0000:  0001 0800 0604 0001 5478 1a86 50c9 0a28  ........Tx..P..(
    0x0010:  0001 ffff ffff ffff 0a28 0005            .........(..

tcpdump (receiver):

# tcpdump -nnvvXSs 1514 arp -i eth1
tcpdump: WARNING: eth1: no IPv4 address assigned
tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size 1514 bytes
21:32:29.532966 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 10.40.0.5 (ff:ff:ff:ff:ff:ff) tell 10.40.0.1, length 46
    0x0000:  0001 0800 0604 0001 5478 1a86 50c9 0a28  ........Tx..P..(
    0x0010:  0001 ffff ffff ffff 0a28 0005 0000 0000  .........(......
    0x0020:  0000 0000 0000 0000 0000 dac7 07ed       ..............

The arp packet received is 18 bytes larger than the arp packet sent. I'm trying to figure out whether or not this is normal, or a problem. (This packet is ultimately bound for a virtual machine instance which isn't receiving it correctly).

Who is adding those 18 bytes, and why? Is it the sender, the switch, or the receiver? And what do they mean?

My suspicion is that it's the (Cisco Nexus 3000) switch, and it's related to 802.1Q encapsulation.

Best Answer

46 bytes is the minimum amount of user data permitted in an Ethernet packet.

There's an 8 byte preamble, a 6 byte destination MAC, a 6 byte source MAC, a 2 byte type/length, user data, and a 4 byte frame check sequence. Since the minimum packet is 64 bytes, that means the user data cannot be fewer than 46 bytes.

Every protocol layered on top of Ethernet must deal with this. ARP deals with it by ignoring "junk" after the data.

Related Topic