Wireshark-users: Re: [Wireshark-users] Incorrect report by wireshark ?

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 26 Sep 2007 17:57:37 -0700

On Sep 26, 2007, at 2:03 PM, Saikiran Madugula wrote:

I am new to wireshark. Following is a capture of a frame
by wireshark (tshark -V). I always though that
Ethernet frames are of minimum length 64bytes. How can
wireshark say that the frame is indeed 60 bytes on wire, while
it is 64 (including CRC).

Because some Ethernet adapters either don't provide the CRC to the host, or can be configured to do so but the driver isn't doing so.

If the adapter isn't providing the CRC to the host, the frame length of received frames will be a minimum of 60 bytes; if the adapter is providing the CRC to the host, it'll be 64 bytes.

(Frames sent by the host running Wireshark are not guaranteed to be padded at all, so they might appear to be less than 60 bytes long; they will also not include the CRC. That's because a copy of the packet is provided to the mechanism libpcap/WinPcap uses, and thus to the application using libpcap/WinPcap - for example, Wireshark - directly in software, bypassing the network adapter and thus bypassing the CRC calculation and perhaps even bypassing the padding.)