Arpspoof uses Generator ID 112 and uses the following SIDS for that GID: “Event description” Cisco deals with multicast using CGMP and IGMP Snooping. One of you asked how a host knows the length of an Ethernet II frame if the frame doesn’t carry a length filed like 802.3. This FAQ claims:The IP header length only specifies the length the IP header. TCP contains an offset to application data which helps us know the length. Cisco says:I’ve never tried it, but I might now.”]
Source: https://taosecurity.blogspot.com/2006/12/tcpip-weapons-school-part-1-wrap-up.html