This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Ethernet Frame Check Sequence Incorrect - Is this a concern?

0

Hello,

Fairly new to Wireshark. When I ran this capture on an ip address it has this Ethernet FCS Incorrect event for every ping. I'm not sure if this is something I need to worry about or not.

I was capturing a Class B network checking for FCS incorrect events and it was alarming.

I don't see a way to add the capture here?

asked 11 Mar '14, 18:53

sharkme's gravatar image

sharkme
11223
accept rate: 0%


One Answer:

2

You can upload your capture file somewhere else, like www.cloudshark.org, and then include a link to it in your question.

Usually incorrect Frame Check Sequences are not a problem. Almost all modern network cards do checksum offloading; that is, the FCS is calculated and applied by the NIC instead of by the OS. If you're capturing on one of the endpoints, Wireshark will see frames transmitted by that system before the FCS is calculated and added by the NIC.

Some signs that incorrect Frame Check Sequences are just due to checksum offloading, and are not really an error:

  1. The incorrect Frame Check Sequences are only on frames transmitted by the system that you captured on.
  2. The communication succeeds. In this case, you get a reply to the pings. If the Frame Check Sequences were really incorrect, the frames would be discarded and the communication would fail.

Its usually better to capture from the wire instead of from either of the endpoints involved in the communication. There are other reasons, besides checksum offloading, why the packets that are transmitted on the wire will be different from packets captured on an endpoint.

answered 11 Mar '14, 21:04

Jim%20Aragon's gravatar image

Jim Aragon
7.2k733118
accept rate: 24%