Different length between ping and tcpdump

I do not why I am not able to see under tcpdump the correct length value which should be $((9706-28)) = 9678, but I see 9686. On both side there is a MTU set to 9706 which maximum value for the interface which I am using.

I run command:

ping -D -s $((**9706**-28)) 192.11.14.28
PING u1428-11 (190.11.14.28): 9678 data bytes
**9686** bytes from 192.11.14.28: icmp_seq=0 ttl=64 time=0.249 ms
**9686** bytes from 192.11.14.28: icmp_seq=1 ttl=64 time=0.421 ms

And check tpcdump:

tcpdump -nevvvi mlnx0
192.11.14.29 > 192.11.14.28: ICMP echo request, id 23329, seq 1, length **9686**
11:41:35.881615 3a:db:46:ce:e8:b7 > 52:54:00:7d:3d:59, ethertype 802.1Q (0x8100), length 9724: vlan 100, p 0, ethertype IPv4, (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 9706)

Solution 1:

The packet size you pass to the ping command does not include the 8 byte ICMP header, only the payload size. From the man page:

       -s packetsize
           Specifies the number of data bytes to be sent. The default is 56,
           which translates into 64 ICMP data bytes when combined with the 8
           bytes of ICMP header data.

Thus if you specify a payload size of 9678, the packet on the wire will be 9686 bytes.