Ask Your Question

Where is the FCS field shown in the WireShark output?

asked 2020-11-08 23:47:11 +0000

tj gravatar image

Where is the FCS field shown in the WireShark output? The DataLink PDU always ends with the TYPE field, but shouldn't there be a PAYLOAD, CRC/FCS, and IPG fields shown somewhere also?

edit retag flag offensive close merge delete


What link-layer protocol is this?

Guy Harris gravatar imageGuy Harris ( 2020-11-08 23:51:09 +0000 )edit

Thanks for the reply,

It's Ethernet from my laptop connected to my Dlink router. Studying for my CCNA and I'm trying to compare the fields in the book illustrations to the actual WS output. In expanding a single frame, I was wondering why after the Application Layer the output ends and it doesn't show the tail of the frame.

tj gravatar imagetj ( 2020-11-09 00:12:10 +0000 )edit

2 Answers

Sort by ยป oldest newest most voted

answered 2020-11-09 00:51:00 +0000

Guy Harris gravatar image

Where is the FCS field shown in the WireShark output?

It's shown in the Ethernet header IF it's present.

Note that there is no guarantee that it's present in a capture, however. It will be present only if:

  1. the Ethernet adapter can be configured to provide it to the host;
  2. the driver for the adapter configures it to do so;
  3. the packet capture code path in the driver and the OS networking code provides it as part of the packet payload.

If it is not present, and you enable "Assume packets have FCS", Wireshark will dissect the last 4 bytes of the Ethernet payload as if it were the FCS.

The payload is dissected based on the type/length field value; it's not included as part of the "Ethernet" section of the packet details, it will either be its own protocol at the top level (for example, IPv4 or IPv6, or, if it's a length field, IEEE 802.2 or, for some old Netware packets, Netware) or just "Data" if Wireshark doesn't know how to dissect it based on the value in the type/length field (i.e., an Ethernet type value that Wireshark doesn't know about).

The inter-packet gap isn't part of the packet - that's what "inter-packet" implies! - so there's nothing to display.

edit flag offensive delete link more


Awesome thank you!

tj gravatar imagetj ( 2020-11-09 01:52:33 +0000 )edit

answered 2020-11-09 00:22:49 +0000

tj gravatar image

Found it: Edit -> Preferences -> Protocols -> Ethernet -> Assume packets have FCS

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2020-11-08 23:47:11 +0000

Seen: 5,742 times

Last updated: Nov 09 '20