Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Ethernet FCS Trailer

From: Abhijeet <abhijeet.churmure@xxxxxxxxx>
Date: Wed, 23 Feb 2011 22:11:58 -0800 (PST)
HI Everybody

Thanks for u r help.
 
Regards
Abhijeet.C



From: Guy Harris <guy@xxxxxxxxxxxx>
To: Community support list for Wireshark <wireshark-users@xxxxxxxxxxxxx>
Cc: Abhijeet <vyaaghrah-wire@xxxxxxxxx>
Sent: Wednesday, February 23, 2011 4:43 AM
Subject: Re: [Wireshark-users] Ethernet FCS Trailer


On Feb 22, 2011, at 9:17 AM, Stephen Fisher wrote:

> When the Ethernet NIC receives a frame on the wire, it checks the 4 byte
> Frame Check Sequence (FCS/CRC) at the end of the frame.  If it fails the
> check, the frame is discarded.  If it passes, it is almost always
> stripped and then the remaining portion of the frame is sent to the
> computer/operating system/Wireshark.

But not always stripped - the Ethernet drivers in Mac OS X tend to supply the FCS to BPF for incoming packets (but not for outgoing packets, as they're looped back internally, and it's the Ethernet adapter that adds the FCS), which is why...

> Wireshark uses some best guesses to determine if it's a checksum or
> other trailer.