I am having a small question regarding wireshark , In which Layer wireshark works. I.e , on which Layer wireshark capturing the data ? Because I am not getting Ethernet header checksum in my capture , Any Idea ? Thanks asked 28 Nov '13, 21:03  si98765 edited 28 Nov '13, 21:07 |
2 Answers:
It generally captures at the link layer. That does not, however, mean that the FCS is included (I assume by "Ethernet header checksum" you mean the Ethernet FCS; it is a checksum on the entire packet, not the header). It usually isn't, as the driver usually doesn't configure the Ethernet adapter to provide the FCS of incoming packets to the host (and outgoing packets are captured before the adapter sees the packet and adds the FCS). Sometimes it's provided, but usually it isn't. answered 29 Nov '13, 01:32  Guy Harris ♦♦ |
See the answer and the comments to a similar question
Regards answered 29 Nov '13, 06:28  Kurt Knochner ♦ |
