This is our old Q&A Site. Please post any new questions and answers at

In which condition Wireshark does not see 64 - 127 byte unicast frames? I have a specific converter connected to PC and according to egress interface counters of this converter, it sends 64 - 127 byte unicast frames towards the PC, but Wireshark running in PC does not see those frames. I am aware that those packets are malformed. Is it possible that certain NIC's drop unicast frames targeted to some other destination MAC address other than the one they have? In which condition PC running Wireshark does not see unicast frames?

asked 10 Oct '13, 06:00

mrtn's gravatar image

accept rate: 0%

If the packets are malformed it probably means that the checksums are incorrect as well, so it is quite possible that the NIC/NIC driver decides to drop the frame and never tells Wireshark about it. I assume you do you captures in promiscuous mode, which should lead to the NIC accepting MACs other than its own. Still, broken checksums could lead to the frame being dropped.

permanent link

answered 10 Oct '13, 06:06

Jasper's gravatar image

Jasper ♦♦
accept rate: 18%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 10 Oct '13, 06:00

question was seen: 1,510 times

last updated: 10 Oct '13, 06:06

p​o​w​e​r​e​d by O​S​Q​A