Wireshark-users: Re: [Wireshark-users] Incorrect report by wireshark ?
From: Saikiran Madugula <[email protected]>
Date: Thu, 27 Sep 2007 11:33:44 -0400
Frames sent by the host running Wireshark are not guaranteed to be padded at all,
so they might appear to be less than 60 bytes long; they will also not include the CRC. That's because a copy of the packet is provided to the mechanism libpcap/WinPcap uses, and thus to the application using libpcap/WinPcap - for example, Wireshark - directly in software, bypassing the network adapter and thus bypassing the CRC calculation and perhaps even bypassing the padding.
Now I understand. The report of xx bytes on *wire* by wireshark just 
confused me a lot.