My understanding is that a minimum layer 2 Ethernet II frame has to be 64 bytes in length, which includes the 4-byte FCS. Since the FCS is not normally available to Wireshark, only 60 bytes are shown. Thus, in a TCP packet that has an empty payload, there are 6 padding bytes at the end of the frame that are highlighted along with the Ethernet II header. So,
14-byte Ethernet II header 20-byte IPv4 header 20-byte TCP header 6-byte padding
gives the total at 60 bytes.
In my testing, I'm running across a 54-byte packet that shows no padding bytes. It has the 14-byte Ethernet II header, the 20-byte IPv4 header, and the 20-byte TCP header for a total of 54 bytes. It is the ACK packet that follows the SYN and SYN,ACK handshake.
Is there an explanation as to why this packet is 54 bytes long and not padded out to 60 bytes? Is this a network setting of some kind?
