Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I log the length of a echo-request packet,

iptables -A OUTPUT -p icmp -m icmp --icmp-type 8 -j LOG

I saw the length was LEN=84, but in wireshark, the captured packet size was 0x60, why does it differ?

share|improve this question

The LEN is decimal where the 0x in the wireshark output indicates hexadecimal. 16 * 6 = 96

If you are looking at the Ethernet frame, then you would have to subtract 14 or 18 (with vlan tag) from that leaving me with either 82 or 78. If this is the size of the encapsulating IP packet, then this would be rather big and lead me to assume you adjusted the size with ping -s

Normally an icmp type 8 packet generated by Linux ipv4 ping without arguments has 48 bytes of "data" with 16 bytes of ICMP header and 20 bytes IP header leaving you with a 84 Byte IP packet. so are you sure you are looking at the right number in wireshark?

(This isn't really an answer but it's too long for a comment to make sense)

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.