Forum Home
Press F1
Thread ID: 88800	2008-04-09 13:12:00	RFC:791 - Can someone please explain this to me :s	WarNox (8772)	Press F1

Post ID	Timestamp	Content	User
657388	2008-04-09 13:12:00	Hi! What I am trying to figure out is why WireShark imposes a maximum and minimum limit on the size of packets you can capture . Maximum being 65535 bytes and minimum being 68 bytes . I figure for the maximum its because that is the largest allowed size for a packet and im a bit lost when it comes to the lowest limit . I know 68 bytes is the smallest packet any networking device must be able to forward without further fragmentation, but reading this extract from RFC: 791 I get confused: Every internet module must be able to forward a datagram of 68 octets without further fragmentation . This is because an internet header may be up to 60 octets, and the minimum fragment is 8 octets What is "minimum fragment of 8 octets/bytes"? 60 octets/bytes is the maximum size for an ip header, I guess with all the possible options and padding because normally its only about 20 bytes . Hope someone can help with this, Thanks . Gregor	WarNox (8772)
657389	2008-04-09 20:38:00	Hi! What is "minimum fragment of 8 octets/bytes"? 60 octets/bytes is the maximum size for an ip header, I guess with all the possible options and padding because normally its only about 20 bytes . the 8 bytes are the payload of the packet . so we end up with 60 bytes of header and 8 bytes of payload . we MUST have at least 1 byte of payload or otherwise we are pushing nothing around the network . in the RFC they decided to go for 8 bytes of payload as a minimum, this is problme due to small RAM size in old computers . so by the rules we must support a maximum header of 60 bytes and then 8 bytes of payload . which makes for a minimum packet size of 68 bytes . a good number of packets will have a header of less than 60 bytes and so total packet size could be less than 68 bytes .	robsonde (120)
657390	2008-04-09 23:34:00	Cool, thanks for the explanation :)	WarNox (8772)
1