 | 1 | initial version |
The padding of Ethernet frames is done on the NIC of the system. The capturing of packets is done somewhere in the kernel of the OS. So all outgoing frames from the system on which you are capturing will pass the capture process (npcap/libpcap) before they reach the NIC where they are padded to 64 bytes.
This also happens with checksums when you have checksum offloading enabled, then all outgoing frames will have a bad checksum at the IP/TCP/UDP layer, as they are captured before the NIC can calculate and populate the checksum fields.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
