I captured a ping to my default gateway with Wireshark. I'm now wondering about the "Length" field. From what I already know, the Preamble and FCS fields are not shown by Wireshark. So is this the REAL Frame length? I mean it includes all fields from Preamble to FCS included ?
thank you for clarification !
asked 05 Aug '15, 06:25
No, the length field is displayed by Wireshark. As you stated, the Ethernet preamble is not displayed by Wireshark. Therefore, the length does not include the preamble.
To confirm this, observe the Packet Details and Packet Bytes section in Wireshark. There are no Ethernet preamble bits shown in either. If you count the bits in the Packet Bytes section it will match the length field.
answered 05 Aug '15, 06:36
Wireshark is showing you the length of the Ethernet frame that is handed to it, which may or may not include the FCS. No capture hardware that I'm aware of saves the preamble or SFD bytes (if it did, it would probably require a new DLT), and most common capture hardware strips away the FCS so that Wireshark (or any packet analysis tool) never sees it. Some capture hardware does retain the FCS though, in which case it could be present in the capture file, and if it is, the Ethernet frame length will reflect those bytes as well.
answered 05 Aug '15, 08:16