Where is the FCS field shown in the WireShark output? The DataLink PDU always ends with the TYPE field, but shouldn't there be a PAYLOAD, CRC/FCS, and IPG fields shown somewhere also?
Where is the FCS field shown in the WireShark output?
It's shown in the Ethernet header IF it's present.
Note that there is no guarantee that it's present in a capture, however. It will be present only if:
If it is not present, and you enable "Assume packets have FCS", Wireshark will dissect the last 4 bytes of the Ethernet payload as if it were the FCS.
The payload is dissected based on the type/length field value; it's not included as part of the "Ethernet" section of the packet details, it will either be its own protocol at the top level (for example, IPv4 or IPv6, or, if it's a length field, IEEE 802.2 or, for some old Netware packets, Netware) or just "Data" if Wireshark doesn't know how to dissect it based on the value in the type/length field (i.e., an Ethernet type value that Wireshark doesn't know about).
The inter-packet gap isn't part of the packet - that's what "inter-packet" implies! - so there's nothing to display.
Awesome thank you!
Found it: Edit -> Preferences -> Protocols -> Ethernet -> Assume packets have FCS
Asked: Nov 8 '0
Seen: 7,089 times
Last updated: Nov 09 '20
What link-layer protocol is this?
Thanks for the reply,
It's Ethernet from my laptop connected to my Dlink router. Studying for my CCNA and I'm trying to compare the fields in the book illustrations to the actual WS output. In expanding a single frame, I was wondering why after the Application Layer the output ends and it doesn't show the tail of the frame.