Ethernet CRC check in Wireshark

Discussion in 'Linux Networking' started by jprudent, Mar 23, 2011.

  1. jprudent

    jprudent Guest

    Hi!

    I read that Ethernet add a CRC footer after payload.

    I tried to observe this in WireShark in an ICMP PING request.

    I can observe source, and destination mac, then the payload, but no
    CRC.

    Is the CRC somehow disappeared? Or is not sent? Or not shown in
    Wireshark?

    Thanks.
     
    jprudent, Mar 23, 2011
    #1
    1. Advertisements

  2. jprudent

    jprudent Guest

    Here is the icmp request (pcap, base64 encoded)
    1MOyoQIABAAAAAAAAAAAAP//
    AAABAAAA0reJTYtdDgBiAAAAYgAAAAAbdw8hegAjaRyYDQgARQAA
    VLBWAAAuATaj0VWvaMCoZEkAAIgVB3oABNG3iU0gZAoACAkKCwwNDg8QERITFBUWFxgZGhscHR4f
    ICEiIyQlJicoKSorLC0uLzAxMjM0NTY3
     
    jprudent, Mar 23, 2011
    #2
    1. Advertisements

  3. jprudent

    pk Guest

    The CRC is added and removed by the hardware, so the OS, even at the lowest
    level (where Wireshark hooks in) can't see it.
     
    pk, Mar 23, 2011
    #3
  4. I believe it's only on the wire. There is no reason to pass the CRCs
    around -- they're only meaningful on the wire.

    DS
     
    David Schwartz, Mar 23, 2011
    #4
  5. jprudent

    jprudent Guest

    Thanks!
     
    jprudent, Mar 26, 2011
    #5
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.