Wireshark-users: Re: [Wireshark-users] Incorrect report by wireshark ?
Thanks.
Frames sent by the host running Wireshark are not guaranteed to be padded at all,
so they might appear to be less than 60 bytes long; they will also not
include the CRC.
That's because a copy of the packet is provided to the mechanism
libpcap/WinPcap uses,
and thus to the application using libpcap/WinPcap - for example,
Wireshark - directly in software,
bypassing the network adapter and thus bypassing the CRC calculation and
perhaps even bypassing the padding.
Now I understand. The report of xx bytes on *wire* by wireshark just
confused me a lot.
Kiran.