Does "Frame Length" include also CRC-Bytes? When a packet is shown 60 bytes on wire, 60 bytes captured Frame Length: 60 bytes Capture Length: 60 bytes and also the hex/data-view shows 60 bytes Does this mean that the 4-CRC-Bytes / FCS is included also (but my NIC normally does not provide the CRC to the host)? But if this is not the case should'nt it be "64 bytes on wire" but "60 bytes captured"? My Background is that i write a file-export to the pcap-Format and i have no CRC-Bytes in my data and so i would say that i have 64Bytes on wire (including the CRC-Bytes) but only 60Bytes captured. Wireshark says now that the packet is truncated (which is correct for my opinion), anyhow i wonder why the packets captured via winpcap are "not" also shown as truncated? Is here the "bytes on wire" rather more a "bytes on wire without CRC"??? Thanks for responses!!! asked 14 Dec '10, 07:05  fdxshark |
One Answer:
Yes, it is "bytes on wire without CRC", which is a very common thing for network analyzer file formats. The explanation I was told is that the 4 bytes FCS were not stored to spare the memory for it. Nowadays with that much memory we all have it may be hard to understand, but those 4 bytes were really valuable back in the days of "640k should be enough for everybody" :-) On a side note: I have one high end gigabit capture device though that does write the FCS into the tracefile, but all others don't. Edit: I forgot: the FCS also isn't that important, because if it is not correct the frame would be dropped at the first NIC/Switchport it is received. You wouldn't even be able to capture it with Wireshark even if it makes it to your NIC. answered 14 Dec '10, 09:33  Jasper ♦♦ edited 14 Dec '10, 09:34 |
