data-link-layer

问题 I am trying to get the source MAC address of every packet being dumped on the network, excluding any packets involving the host machine. I expect that in order to accomplish this I should get the data from tcpdump with the host's network interface in promiscuous mode. Note that I am not interested in getting the full header or even the link level header. The -e option is not what I want. I just want the source MAC address for each packet, and nothing more. This is what I am currently doing

问题 An Ethernet Frame Check Sequence is always appended to the end of a frame in the Data Link Layer. Why is it appended to the end of the frame and not somewhere else? I thought about it and think it might have something to do with how e.g. CRC-checksums are calculated and that it's easier performed by hardware if the structure of a frame is header+payload+crc rather than header+crc+payload. CRC performs an XOR division of the form (data+padding)/divisor, and for the final frame the padding is