When seeing short packets, tcpdump prints out a warning like this: 09:39:12.829833 < truncated-ip - 46 bytes missing!192.168.42.112 > thinktwice: i cmp: echo request 4500 005c 8719 0000 ff01 5ec3 c0a8 2a70 c0a8 2a03 0800 cee9 3412 0500 1402 0000 0000 0000 0800 0000 0c00 0000 1000 But as can be seen, it's printing the length of the packet in the warning, not the number of bytes missing (60-46 = 14). Jesper
look at the packet header: 4500 005c 5c is the length. 5c is 92. tcpdump is right, cause 92-46 = 46!