 | 1 | initial version |
There is a very simple explanation for seeing frames shorter than 64 (60 without FCS) bytes. Those frames are sent by the system on which the packets are captured. The reason for the packets to be shorter is, as you already discovered, that the padding is not there. And this is because the padding is added by the NIC. As outgoing packets pass libpcap/winpcap/npcap on the way to the NIC, the padding has not taken place yet, resulting in short frames.
This is one of the reasons why it is better to use a TAP or SPAN-port to capture the packets. But please make sure all offloading features of the NIC are turned off to make sure it passes the packets as they are seen on the network.
