Subject: Re: xircom error
To: Manuel Bouyer <>
From: Steven M. Bellovin <>
List: port-i386
Date: 11/28/2001 14:54:10
In message <>, Manuel Bouyer writes:
>On Wed, Nov 28, 2001 at 05:58:24PM -0000, David Laight wrote:
>> > Is xi0: discarding oversize frame (len=1518) a sign that the ethernet card
>> > is broken in someway, or just something that happens during normal network
>> > operation
>> Is is more likely that the device driver of the system that SENT the
>> packet is broken...
>> No ethernet frame should ever contain more then 1516 bytes (including the
>> destination address, but excluding the CRC).
>It can be 4 bytes larger, if you use 802.1Q VLAN tagging.

And I think the limit without that is 1514 -- src&dst are 6 bytes, and 
the type field is 2, added to the IP MTU of 1500.  The CRC is 4 bytes, 
which is where 1518 comes from.

		--Steve Bellovin,
		Full text of "Firewalls" book now at