On Sep 26, 2007, at 2:03 PM, Saikiran Madugula wrote:
I am new to wireshark. Following is a capture of a frame
by wireshark (tshark -V). I always though that
Ethernet frames are of minimum length 64bytes. How can
wireshark say that the frame is indeed 60 bytes on wire, while
it is 64 (including CRC).
Because some Ethernet adapters either don't provide the CRC to the
host, or can be configured to do so but the driver isn't doing so.
If the adapter isn't providing the CRC to the host, the frame length
of received frames will be a minimum of 60 bytes; if the adapter is
providing the CRC to the host, it'll be 64 bytes.
(Frames sent by the host running Wireshark are not guaranteed to be
padded at all, so they might appear to be less than 60 bytes long;
they will also not include the CRC. That's because a copy of the
packet is provided to the mechanism libpcap/WinPcap uses, and thus to
the application using libpcap/WinPcap - for example, Wireshark -
directly in software, bypassing the network adapter and thus bypassing
the CRC calculation and perhaps even bypassing the padding.)
