This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Does "Frame Length" include also CRC-Bytes?

When a packet is shown 60 bytes on wire, 60 bytes captured Frame Length: 60 bytes Capture Length: 60 bytes

and also the hex/data-view shows 60 bytes

Does this mean that the 4-CRC-Bytes / FCS is included also (but my NIC normally does not provide the CRC to the host)? But if this is not the case should'nt it be "64 bytes on wire" but "60 bytes captured"?

My Background is that i write a file-export to the pcap-Format and i have no CRC-Bytes in my data and so i would say that i have 64Bytes on wire (including the CRC-Bytes) but only 60Bytes captured. Wireshark says now that the packet is truncated (which is correct for my opinion), anyhow i wonder why the packets captured via winpcap are "not" also shown as truncated? Is here the "bytes on wire" rather more a "bytes on wire without CRC"???

Thanks for responses!!!

asked 14 Dec '10, 07:05

fdxshark's gravatar image

fdxshark
1111
accept rate: 0%


Yes, it is "bytes on wire without CRC", which is a very common thing for network analyzer file formats. The explanation I was told is that the 4 bytes FCS were not stored to spare the memory for it. Nowadays with that much memory we all have it may be hard to understand, but those 4 bytes were really valuable back in the days of "640k should be enough for everybody" :-)

On a side note: I have one high end gigabit capture device though that does write the FCS into the tracefile, but all others don't.

Edit: I forgot: the FCS also isn't that important, because if it is not correct the frame would be dropped at the first NIC/Switchport it is received. You wouldn't even be able to capture it with Wireshark even if it makes it to your NIC.

permanent link

answered 14 Dec '10, 09:33

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

edited 14 Dec '10, 09:34

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×16
×6
×6

question asked: 14 Dec '10, 07:05

question was seen: 8,636 times

last updated: 14 Dec '10, 09:34

p​o​w​e​r​e​d by O​S​Q​A