Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

Ethernet CRC check in Wireshark

230 views
Skip to first unread message

jprudent

unread,
Mar 23, 2011, 7:03:42 AM3/23/11
to
Hi!

I read that Ethernet add a CRC footer after payload.

I tried to observe this in WireShark in an ICMP PING request.

I can observe source, and destination mac, then the payload, but no
CRC.

Is the CRC somehow disappeared? Or is not sent? Or not shown in
Wireshark?

Thanks.

jprudent

unread,
Mar 23, 2011, 7:08:31 AM3/23/11
to
Here is the icmp request (pcap, base64 encoded)
1MOyoQIABAAAAAAAAAAAAP//
AAABAAAA0reJTYtdDgBiAAAAYgAAAAAbdw8hegAjaRyYDQgARQAA
VLBWAAAuATaj0VWvaMCoZEkAAIgVB3oABNG3iU0gZAoACAkKCwwNDg8QERITFBUWFxgZGhscHR4f
ICEiIyQlJicoKSorLC0uLzAxMjM0NTY3

David Schwartz

unread,
Mar 23, 2011, 4:07:25 PM3/23/11
to

I believe it's only on the wire. There is no reason to pass the CRCs
around -- they're only meaningful on the wire.

DS

pk

unread,
Mar 23, 2011, 3:54:58 PM3/23/11
to

The CRC is added and removed by the hardware, so the OS, even at the lowest
level (where Wireshark hooks in) can't see it.

jprudent

unread,
Mar 26, 2011, 9:55:24 AM3/26/11
to
On Mar 24, 2:54 am, pk <p...@pk.invalid> wrote:
> On Wed, 23 Mar 2011 04:03:42 -0700 (PDT)
>
> jprudent <jprud...@gmail.com> wrote:
> > Hi!
>
> > I read that Ethernet add a CRC footer after payload.
>
> > I tried to observe this in WireShark in an ICMP PING request.
>
> > I can observe source, and destination mac, then the payload, but no
> > CRC.
>
> > Is the CRC somehow disappeared? Or is not sent? Or not shown in
> > Wireshark?
>
> > Thanks.
>
> The CRC is added and removed by the hardware, so the OS, even at the lowest
> level (where Wireshark hooks in) can't see it.

Thanks!

0 new messages