From: Guy Harris <guy@xxxxxxxxxxxx>
To: Community support list for Wireshark <wireshark-users@xxxxxxxxxxxxx>
Cc: Abhijeet <vyaaghrah-wire@xxxxxxxxx>
Sent:
Wednesday, February 23, 2011 4:43 AM
Subject: Re: [Wireshark-users] Ethernet FCS Trailer
On Feb 22, 2011, at 9:17 AM, Stephen Fisher wrote:
> When the Ethernet NIC receives a frame on the wire, it checks the 4 byte
> Frame Check Sequence (FCS/CRC) at the end of the frame. If it fails the
> check, the frame is discarded. If it passes, it is almost always
> stripped and then the remaining portion of the frame is sent to the
> computer/operating system/Wireshark.
But not always stripped - the Ethernet drivers in Mac OS X tend to supply the FCS to BPF for incoming packets (but not for outgoing packets, as they're looped back internally, and it's the Ethernet adapter that adds the FCS), which is why...
> Wireshark uses some best guesses to determine if it's a checksum or
> other trailer.
