Ask Your Question

Revision history [back]

Why 40 bytes overhead at end of TCP/IP Frames?

Running a tcpip socket exchange between 2 apps on the same VMWare Windows server (loopback). Wireshark shows an extra 40 bytes (nominal) at the end of every frame.

The extra bytes are not present if the same exchange is run on a standalone Windows laptop.

What are these extra bytes (bold below)?

Windows Server Exchange (sample data frame)

  • 0000 02 00 00 00 45 02 00 37 9a 72 40 00 80 06 00 00
  • 0010 0a 18 11 0d 0a 18 11 0d cc 44 27 48 4f 82 81 6a
  • 0020 87 16 6c 5f 50 18 40 00 40 4b 00 00 01 30 30 30
  • 0030 30 30 31 02 30 32 38 30 43 44 03 00 00 00 00 00
  • 0040 86 db 00 00 00 00 01 00 00 00 00 00 89 00 12 00
  • 0050 00 00 00 00 00 00 00 00 20 00 00 00 00 00 00 00
  • 0060 34 00 00 (data italics, extra bytes bold)

Standalone Laptop Exchange (same sample data frame)

  • 0000 02 00 00 00 45 00 00 37 c2 19 40 00 80 06 00 00
  • 0010 c0 a8 01 72 c0 a8 01 72 d8 50 1b dd cd eb e9 99
  • 0020 4c 92 46 64 50 18 40 00 6b a5 00 00 01 30 30 30
  • 0030 30 30 31 02 30 32 38 30 43 44 03