Revision history [back]

Where is the FCS field shown in the WireShark output?

It's shown in the Ethernet header IF it's present.

Note that there is no guarantee that it's present in a capture, however. It will be present only if:

1. the Ethernet adapter can be configured to provide it to the host;
2. the driver for the adapter configures it to do so;
3. the packet capture code path in the driver and the OS networking code provides it as part of the packet payload.

If it is not present, and you enable "Assume packets have FCS", Wireshark will dissect the last 4 bytes of the Ethernet payload as if it were the FCS.

The payload is dissected based on the type/length field value; it's not included as part of the "Ethernet" section of the packet details, it will either be its own protocol at the top level (for example, IPv4 or IPv6, or, if it's a length field, IEEE 802.2 or, for some old Netware packets, Netware) or just "Data" if Wireshark doesn't know how to dissect it based on the value in the type/length field (i.e., an Ethernet type value that Wireshark doesn't know about).

The inter-packet gap isn't part of the packet - that's what "inter-packet" implies! - so there's nothing to display.