Thanks. > Frames sent by the host running Wireshark are not guaranteed to be padded at > all, so they might appear to be less than 60 bytes long; they will also not include the CRC. That's because a copy of the packet is provided to the mechanism libpcap/WinPcap uses, and thus to the application using libpcap/WinPcap - for example, Wireshark - directly in software, bypassing the network adapter and thus bypassing the CRC calculation and perhaps even bypassing the padding.
Now I understand. The report of xx bytes on *wire* by wireshark just confused me a lot. Kiran. _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
