title: why does libpcap/tcpdump add/pad '0x00' bytes at the end of IP/TCP packets？
body: <p>I use both Tcpdump and libpcap(a program which uses libpcap) to capture TCP packets. And I notice there are some packets which are padded/added with additional 0x00 bytes at the end. For example, while the IP length indicated in the IP header says that the length is 40 bytes, tcpdump captures 46 bytes. and I notice there are 6 <code>0x00</code> bytes at the end of the TCP packets.</p>