when ping, specifying the length of the packet by:
ping localhost -l 32
Actually default is -l 32, so if we omit the last option, the sent packets are the same. This packet is of real size of 82, consists of 8 bytes of Physical Layer, 14 bytes of Ethernet Layer, 20 bytes of IP layer, 8 bytes of ICMP header and 32 bytes of data. But we capture this package with wireshark, only to see 74 bytes, because the Physical layer has already been stripped out.
If tried ping with length, we know that the maximum length is 1472, but why?
In here, we find:
The IEEE 802.3ac standard increased the maximum Ethernet frame size from 1518 bytes to 1522 bytes to accommodate the four-byte VLAN tag. Some network devices that do not support the larger frame size will process these frames successfully, but may report them as "baby giant" anomalies.
that the maximum size of a packet is 1522. Note this should be the size of the whole packet.
thus, 1522 - 8 - 14 - 20 - 8 = 1522 - 50 = 1472.
Network: Why 1472B length of ICMP?
原文：http://www.cnblogs.com/sansna/p/6061097.html