Is it possible for Wireshark to indicate that the interframe gap on a network does meet the minimum time of 96 bit times? asked 07 Oct '13, 06:54  CGooden |
One Answer:
Well, you can obviously look at the time stamps and check if the delta is smaller that the interframe gap (0.096 µs for 1Gig/s). However if the accuracy of your time source is not good enough, or the timestamping was done in the kernel (by libpcap and/or winpcap - which may be much later than the packet arrived and it may also vary due to scheduling in the kernel) and not on the NIC, you cannot trust the time stamp. So, to answer your question: No, there is no reliable way in Wireshark to check if the sending system did use a correct interframe gap. The reason is: Most of the time you don't have time stamps that are good enough for that decision. ++ UPDATE ++ There are more problems: The NIC might even drop a frame that comes in to fast (IFG lower than it should be), so the sniffer will not see the frame at all. There might be hardware analyzers that are able to deal with IFG problems, however I don't know any. Regards answered 07 Oct '13, 07:42  Kurt Knochner ♦ edited 07 Oct '13, 16:28 |
That's exactly what I did not want to hear, but is the answer I expected.
(Converted to a comment to match the way this site works. Please see the FaQ).
I'm sorry to have told you ;-))
Hint: If a supplied answer resolves your question can you please "accept" it by clicking the checkmark icon next to it. This highlights good answers for the benefit of subsequent users with the same or similar questions.