This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello,

Fairly new to Wireshark. When I ran this capture on an ip address it has this Ethernet FCS Incorrect event for every ping. I'm not sure if this is something I need to worry about or not.

I was capturing a Class B network checking for FCS incorrect events and it was alarming.

I don't see a way to add the capture here?

asked 11 Mar '14, 18:53

sharkme's gravatar image

sharkme
11223
accept rate: 0%


You can upload your capture file somewhere else, like www.cloudshark.org, and then include a link to it in your question.

Usually incorrect Frame Check Sequences are not a problem. Almost all modern network cards do checksum offloading; that is, the FCS is calculated and applied by the NIC instead of by the OS. If you're capturing on one of the endpoints, Wireshark will see frames transmitted by that system before the FCS is calculated and added by the NIC.

Some signs that incorrect Frame Check Sequences are just due to checksum offloading, and are not really an error:

  1. The incorrect Frame Check Sequences are only on frames transmitted by the system that you captured on.
  2. The communication succeeds. In this case, you get a reply to the pings. If the Frame Check Sequences were really incorrect, the frames would be discarded and the communication would fail.

Its usually better to capture from the wire instead of from either of the endpoints involved in the communication. There are other reasons, besides checksum offloading, why the packets that are transmitted on the wire will be different from packets captured on an endpoint.

permanent link

answered 11 Mar '14, 21:04

Jim%20Aragon's gravatar image

Jim Aragon
7.2k733118
accept rate: 24%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×16

question asked: 11 Mar '14, 18:53

question was seen: 60,421 times

last updated: 11 Mar '14, 21:04

p​o​w​e​r​e​d by O​S​Q​A