This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

In which condition Wireshark does not see 64 - 127 byte unicast frames? I have a specific converter connected to PC and according to egress interface counters of this converter, it sends 64 - 127 byte unicast frames towards the PC, but Wireshark running in PC does not see those frames. I am aware that those packets are malformed. Is it possible that certain NIC's drop unicast frames targeted to some other destination MAC address other than the one they have? In which condition PC running Wireshark does not see unicast frames?

asked 10 Oct '13, 06:00

mrtn's gravatar image

mrtn
11669
accept rate: 0%


If the packets are malformed it probably means that the checksums are incorrect as well, so it is quite possible that the NIC/NIC driver decides to drop the frame and never tells Wireshark about it. I assume you do you captures in promiscuous mode, which should lead to the NIC accepting MACs other than its own. Still, broken checksums could lead to the frame being dropped.

permanent link

answered 10 Oct '13, 06:06

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×9

question asked: 10 Oct '13, 06:00

question was seen: 1,467 times

last updated: 10 Oct '13, 06:06

p​o​w​e​r​e​d by O​S​Q​A