[Guy Harris <guy@xxxxxxxxxx>]

> This is probably the 'wrong mailing-list' (tm) type of question, but
> does anyone happen to know whether libpcap (or directly ethereal) can
> get the CRC info from the captured Ethernet frame ? Or is this CRC value
> greedly retained by the network card ?

It may depend on the card.

It may also depend on the driver; even if the card can, or does, provide
the CRC value, the driver might clip it off before handing it to
whatever packet capture mechanism your OS provides.

If the card or driver won't supply it, libpcap can't get it, so neither
can tcpdump nor Ethereal nor Ksnuffle nor..., and programs that don't
use libpcap (e.g., snoop) can't do it either.