Wireshark-users: Re: [Wireshark-users] Incorrect report by wireshark ?
From: Guy Harris <[email protected]>
Date: Wed, 26 Sep 2007 17:57:37 -0700
On Sep 26, 2007, at 2:03 PM, Saikiran Madugula wrote:

I am new to wireshark. Following is a capture of a frame
by wireshark (tshark -V). I always though that
Ethernet frames are of minimum length 64bytes. How can
wireshark say that the frame is indeed 60 bytes on wire, while
it is 64 (including CRC).
Because some Ethernet adapters either don't provide the CRC to the  
host, or can be configured to do so but the driver isn't doing so.
If the adapter isn't providing the CRC to the host, the frame length  
of received frames will be a minimum of 60 bytes; if the adapter is  
providing the CRC to the host, it'll be 64 bytes.
(Frames sent by the host running Wireshark are not guaranteed to be  
padded at all, so they might appear to be less than 60 bytes long;  
they will also not include the CRC.  That's because a copy of the  
packet is provided to the mechanism libpcap/WinPcap uses, and thus to  
the application using libpcap/WinPcap - for example, Wireshark -  
directly in software, bypassing the network adapter and thus bypassing  
the CRC calculation and perhaps even bypassing the padding.)