Wireshark-users: Re: [Wireshark-users] Ethernet FCS Trailer
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 22 Feb 2011 15:13:45 -0800
On Feb 22, 2011, at 9:17 AM, Stephen Fisher wrote:

> When the Ethernet NIC receives a frame on the wire, it checks the 4 byte 
> Frame Check Sequence (FCS/CRC) at the end of the frame.  If it fails the 
> check, the frame is discarded.  If it passes, it is almost always 
> stripped and then the remaining portion of the frame is sent to the 
> computer/operating system/Wireshark.

But not always stripped - the Ethernet drivers in Mac OS X tend to supply the FCS to BPF for incoming packets (but not for outgoing packets, as they're looped back internally, and it's the Ethernet adapter that adds the FCS), which is why...

> Wireshark uses some best guesses to determine if it's a checksum or 
> other trailer.