In which condition Wireshark does not see 64 - 127 byte unicast frames? I have a specific converter connected to PC and according to egress interface counters of this converter, it sends 64 - 127 byte unicast frames towards the PC, but Wireshark running in PC does not see those frames. I am aware that those packets are malformed. Is it possible that certain NIC's drop unicast frames targeted to some other destination MAC address other than the one they have? In which condition PC running Wireshark does not see unicast frames? asked 10 Oct '13, 06:00  mrtn |
One Answer:
If the packets are malformed it probably means that the checksums are incorrect as well, so it is quite possible that the NIC/NIC driver decides to drop the frame and never tells Wireshark about it. I assume you do you captures in promiscuous mode, which should lead to the NIC accepting MACs other than its own. Still, broken checksums could lead to the frame being dropped. answered 10 Oct '13, 06:06  Jasper ♦♦ |
