Re: [Ethereal-users] RESUME: ARP reply before the request

[Guy Harris <gharris@xxxxxxxxx>]

On Thu, Apr 04, 2002 at 02:58:57PM +0200, akira.nakandakare@xxxxxxxxxxxxx wrote:
> For the smaller messages, I've realized that only my machine has 
> messages smaller than 60 bytes. So, it really seems that Ethereal 
> capture the messages of the machine where it is running in a different 
> way, so that it doesn't capture the machine's Ethernet messages padding 
> bytes.

Correct.

See my mail on the topic.  The packets get forwarded to the packet
capture mechanism, and then to libpcap and then Ethereal or tcpdump
or..., by directly copying them, rather than by receiving them from the
network (Ethernet interfaces generally do not receive their own
transmissions), so, if the networking code or driver doesn't pad them
before handing them to the packet capture mechanism, they won't be
padded when libpcap and the application using libpcap see them.