arp packet received larger than packet sent, why?

Question

I'm trying to debug a networking issue. During this process, I've noticed that when I try to do an arping, the received arp packets are larger than sent arp packets, as outputted by tcpdump.

(Note that both ends have a br100 bridge to the eth1 interface).

Command:

# arping 10.40.0.5 -I br100 -c1
ARPING 10.40.0.5 from 10.40.0.1 br100
Sent 1 probes (1 broadcast(s))
Received 0 response(s)

tcpdump (sender):

# tcpdump -nnvvXSs 1514 arp -i eth1
tcpdump: WARNING: eth1: no IPv4 address assigned
tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size 1514 bytes
21:32:29.529106 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 10.40.0.5 (ff:ff:ff:ff:ff:ff) tell 10.40.0.1, length 28
    0x0000:  0001 0800 0604 0001 5478 1a86 50c9 0a28  ........Tx..P..(
    0x0010:  0001 ffff ffff ffff 0a28 0005            .........(..

tcpdump (receiver):

# tcpdump -nnvvXSs 1514 arp -i eth1
tcpdump: WARNING: eth1: no IPv4 address assigned
tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size 1514 bytes
21:32:29.532966 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 10.40.0.5 (ff:ff:ff:ff:ff:ff) tell 10.40.0.1, length 46
    0x0000:  0001 0800 0604 0001 5478 1a86 50c9 0a28  ........Tx..P..(
    0x0010:  0001 ffff ffff ffff 0a28 0005 0000 0000  .........(......
    0x0020:  0000 0000 0000 0000 0000 dac7 07ed       ..............

The arp packet received is 18 bytes larger than the arp packet sent. I'm trying to figure out whether or not this is normal, or a problem. (This packet is ultimately bound for a virtual machine instance which isn't receiving it correctly).

Who is adding those 18 bytes, and why? Is it the sender, the switch, or the receiver? And what do they mean?

My suspicion is that it's the (Cisco Nexus 3000) switch, and it's related to 802.1Q encapsulation.

Answer 1

46 bytes is the minimum amount of user data permitted in an Ethernet packet.

There's an 8 byte preamble, a 6 byte destination MAC, a 6 byte source MAC, a 2 byte type/length, user data, and a 4 byte frame check sequence. Since the minimum packet is 64 bytes, that means the user data cannot be fewer than 46 bytes.

Every protocol layered on top of Ethernet must deal with this. ARP deals with it by ignoring "junk" after the data.

Answer 2

Just Want to add Extra Information (Networking Perspective) , Why Router not Accept Packets in Which Condition

If Packets Size Below 64 bytes then Router will assume Packets as RUNT and Reject that Packets

( Packets <= 64 Reject RUNT Packets )

Because in Packets header size is 64 header it self, so seems Packets not include with Data some reason of Packets Corruption.

If Packets Size Above Port(Router) MTU(Default 1500 for FastEthernet, 9000 for Gigabit Interface) then Packets Count as GIANT Packets and Reject that Packets . Because Port MTU is 1500 it will not accept that Packets .

(Packets > Port MTU (1500) Reject it as GIANT )

If Packets Size 1519-1564 , this Packets called Jambo baby Packets and accept only where Port MTU is 9000

If All Condition is Pass then Router will do cyclic redundancy check ( CRC )