Re: Ethernet FCS Trailer

[Guy Harris <guy () alum mit edu>]

On Feb 22, 2011, at 9:17 AM, Stephen Fisher wrote:

> When the Ethernet NIC receives a frame on the wire, it checks the 4 byte 
> Frame Check Sequence (FCS/CRC) at the end of the frame.  If it fails the 
> check, the frame is discarded.  If it passes, it is almost always 
> stripped and then the remaining portion of the frame is sent to the 
> computer/operating system/Wireshark.

But not always stripped - the Ethernet drivers in Mac OS X tend to supply the FCS to BPF for incoming packets (but not 
for outgoing packets, as they're looped back internally, and it's the Ethernet adapter that adds the FCS), which is 
why...

> Wireshark uses some best guesses to determine if it's a checksum or 
> other trailer.

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe