1

I have read that Ethernet have a header and a trailer, but in Wireshark I can only see an Ethernet header and no Ethernet trailer.

1 Answer 1

1

Wireshark only shows what it is passed by the NIC driver - with the FCS truncated. Some NICs specifically allow passing the FCS to the upper layer, see the NIC specifications for details.

There are actually two sets of headers and trailers with Ethernet. Wireshark (or any other tool) can only capture data link layer data (L2 header and payload).

The physical layer's preamble, SFD and IPG cannot be captured without special hardware (on many physical layer variants the IPG is actually filled with idle symbols).

This answer shows headers and trailers in each layer in more detail.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.