In message <20011128204646.A392@antioche.eu.org>, Manuel Bouyer writes:
>On Wed, Nov 28, 2001 at 05:58:24PM -0000, David Laight wrote:
>> 
>> > Is xi0: discarding oversize frame (len=1518) a sign that the ethernet card
>> > is broken in someway, or just something that happens during normal network
>> > operation
>> 
>> Is is more likely that the device driver of the system that SENT the
>> packet is broken...
>> 
>> No ethernet frame should ever contain more then 1516 bytes (including the
>> destination address, but excluding the CRC).
>
>It can be 4 bytes larger, if you use 802.1Q VLAN tagging.
>

And I think the limit without that is 1514 -- src&dst are 6 bytes, and 
the type field is 2, added to the IP MTU of 1500.  The CRC is 4 bytes, 
which is where 1518 comes from.

		--Steve Bellovin, http://www.research.att.com/~smb
		Full text of "Firewalls" book now at http://www.wilyhacker.com