Hello, Fairly new to Wireshark. When I ran this capture on an ip address it has this Ethernet FCS Incorrect event for every ping. I'm not sure if this is something I need to worry about or not. I was capturing a Class B network checking for FCS incorrect events and it was alarming. I don't see a way to add the capture here? asked 11 Mar '14, 18:53  sharkme |
One Answer:
You can upload your capture file somewhere else, like www.cloudshark.org, and then include a link to it in your question. Usually incorrect Frame Check Sequences are not a problem. Almost all modern network cards do checksum offloading; that is, the FCS is calculated and applied by the NIC instead of by the OS. If you're capturing on one of the endpoints, Wireshark will see frames transmitted by that system before the FCS is calculated and added by the NIC. Some signs that incorrect Frame Check Sequences are just due to checksum offloading, and are not really an error:
Its usually better to capture from the wire instead of from either of the endpoints involved in the communication. There are other reasons, besides checksum offloading, why the packets that are transmitted on the wire will be different from packets captured on an endpoint. answered 11 Mar '14, 21:04  Jim Aragon |
