IP Networking

When i capture a tcp packet (a normal ACK-RST packet), Snort shows me a total packet lenght of 3C(hex) = 60(dez) and an IpLen of 20(dez) and a TcpLen of 20(dez), so the sizeof the Ethernet header should be: TotalPacketLenght-(IpLen+TcpLen), that would be 60-(20+20) = 20, but i thought that the Ethernet header has a fixed sizeof 14. Whats going on with these 6 Bytes ?

mfg
atmansiddhi

There are at least three different network protocols that are collectively called ethernet. When you are looking at frames you must be specific. All three have a minimum frame size. IP is required to pad the data with octets of zero to prevent an undersize frame. Your frame is very small and probably tripped this minimum.

You also may actually be using 802.3 SNAP which would introduce a SNAP header.

On my linux box i've installed some network card drivers for "IEEE 802.3 or ISO 8802-2" as make menuconfig told me. In /usr/include/linux/if_ether.h they talk about "Min. octets in frame sans FCS" wich would be 60. Is that the right direction ?

That's not only the right direction, it's the very answer you're seeking. If you have documentation stating that your min frame size is 60 octets, why do you expect a frame to be 54 octets in length?

thank you for the help