Any time I see an illustrative image of an Ethernet frame it shows the checksum at the very end of the frame. This makes sense and I understand why it would be there. However, when I look at a packet in Wireshark the CRC appears to be before the payload data in the frame. I assume that Wireshark is showing me the raw data that is on the wire. When transmitting the frame over Ethernet is the CRC somehow moved up in the stream of bits, or is Wireshark just not showing me the exact placement of bits? Or am I just not understanding this correctly?
The FCS or Frame Check Sequence for ethernet when transmitted over the physical medium is "physically"/"electrically"/"optically" transmitted after the payload data in the frame. The FCS field is calculated with a CRC pass over the source mac address, destination mac address, length/type, data and pad fields using a 32-bit cyclic redundancy check (CRC.) It is for these reasons that the FCS occurs after the data fields 'physically'. Since most layer two devices want to be as low in latency as possible, ordering the fields in this way, it makes it real easy for the receiving device to copy the entire frame into a buffer and then perform a CRC check before passing the frame on. A re-ordering or parsing of the frame is not required to perform a CRC check. Likely, most ethernet frame pdu diagrams are showing it to you correctly if FCS appears after payload/data. Wireshark is simply showing it in a different area so a user can evaluate all of the layer 2 details before analyzing the layer 3 data. It makes it real easy to understand a low-level problem if a crc doesn't match so you analyze layer 2 information before proceeding.