Wireshark mailing list archives
Re: Ethernet FCS Trailer
From: Guy Harris <guy () alum mit edu>
Date: Tue, 22 Feb 2011 15:13:45 -0800
On Feb 22, 2011, at 9:17 AM, Stephen Fisher wrote:
When the Ethernet NIC receives a frame on the wire, it checks the 4 byte Frame Check Sequence (FCS/CRC) at the end of the frame. If it fails the check, the frame is discarded. If it passes, it is almost always stripped and then the remaining portion of the frame is sent to the computer/operating system/Wireshark.
But not always stripped - the Ethernet drivers in Mac OS X tend to supply the FCS to BPF for incoming packets (but not for outgoing packets, as they're looped back internally, and it's the Ethernet adapter that adds the FCS), which is why...
Wireshark uses some best guesses to determine if it's a checksum or other trailer.
___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org?subject=unsubscribe
Current thread:
- Ethernet FCS Trailer Abhijeet (Feb 22)
- Re: Ethernet FCS Trailer Stephen Fisher (Feb 22)
- Re: Ethernet FCS Trailer Guy Harris (Feb 22)
- <Possible follow-ups>
- Re: Ethernet FCS Trailer Abhijeet (Feb 23)
- Re: Ethernet FCS Trailer Abhijeet (Feb 24)
- Re: Ethernet FCS Trailer Stephen Fisher (Feb 22)