On Sep 26, 2007, at 2:03 PM, Saikiran Madugula wrote: > I am new to wireshark. Following is a capture of a frame > by wireshark (tshark -V). I always though that > Ethernet frames are of minimum length 64bytes. How can > wireshark say that the frame is indeed 60 bytes on wire, while > it is 64 (including CRC).
Because some Ethernet adapters either don't provide the CRC to the host, or can be configured to do so but the driver isn't doing so. If the adapter isn't providing the CRC to the host, the frame length of received frames will be a minimum of 60 bytes; if the adapter is providing the CRC to the host, it'll be 64 bytes. (Frames sent by the host running Wireshark are not guaranteed to be padded at all, so they might appear to be less than 60 bytes long; they will also not include the CRC. That's because a copy of the packet is provided to the mechanism libpcap/WinPcap uses, and thus to the application using libpcap/WinPcap - for example, Wireshark - directly in software, bypassing the network adapter and thus bypassing the CRC calculation and perhaps even bypassing the padding.) _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
