I'm trying to debug a networking issue. During this process, I've noticed that when I try to do an arping, the received arp packets are larger than sent arp packets, as outputted by tcpdump.

(Note that both ends have a `br100` bridge to the `eth1` interface).

Command:

```
# arping 10.40.0.5 -I br100 -c1
ARPING 10.40.0.5 from 10.40.0.1 br100
Sent 1 probes (1 broadcast(s))
Received 0 response(s)

```

tcpdump (sender):

```
# tcpdump -nnvvXSs 1514 arp -i eth1
tcpdump: WARNING: eth1: no IPv4 address assigned
tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size 1514 bytes
21:32:29.529106 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 10.40.0.5 (ff:ff:ff:ff:ff:ff) tell 10.40.0.1, length 28
    0x0000:  0001 0800 0604 0001 5478 1a86 50c9 0a28  ........Tx..P..(
    0x0010:  0001 ffff ffff ffff 0a28 0005            .........(..

```

tcpdump (receiver):

```
# tcpdump -nnvvXSs 1514 arp -i eth1
tcpdump: WARNING: eth1: no IPv4 address assigned
tcpdump: listening on eth1, link-type EN10MB (Ethernet), capture size 1514 bytes
21:32:29.532966 ARP, Ethernet (len 6), IPv4 (len 4), Request who-has 10.40.0.5 (ff:ff:ff:ff:ff:ff) tell 10.40.0.1, length 46
    0x0000:  0001 0800 0604 0001 5478 1a86 50c9 0a28  ........Tx..P..(
    0x0010:  0001 ffff ffff ffff 0a28 0005 0000 0000  .........(......
    0x0020:  0000 0000 0000 0000 0000 dac7 07ed       ..............

```

The arp packet received is 18 bytes larger than the arp packet sent. I'm trying to figure out whether or not this is normal, or a problem. (This packet is ultimately bound for a virtual machine instance which isn't receiving it correctly). 

Who is adding those 18 bytes, and why? Is it the sender, the switch, or the receiver? And what do they mean? 

My suspicion is that it's the (Cisco Nexus 3000) switch, and it's related to 802.1Q encapsulation.