This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am using the EtherShark tap and it delivers the Ethernet Frame Check Sum, along with the rest of the frame, to Wireshark. Wireshark dissector for PNIO messages incorrectly assumes that the FCS is part of the Profinet data resulting in the following errors: 1) Cycle number incorrectly identified as the first 2 bytes of the FCS 2) Data Status incorrectly identified as byte 3 of FCS 3) Transfer Status incorrectly identified as byte 4 of FCS 4) Profinet IO Cyclic Service Data Unit length bloated by 4 bytes 5) User Data (including GAP and RTCPadding) bloated by 4 bytes.

Other profinet messages seem unaffected, although I have not studied other message types in great detail as of yet.

I tried using editcap to remove the last 4 bytes but this did not work as the dissectors recognized the bytes were missing.

How can I work around this problem??

asked 14 Nov '14, 07:26

mark_w1's gravatar image

mark_w1
15113
accept rate: 0%


Have you tried setting the preferences for the Ethernet dissector to "Assume packets have FCS"?

permanent link

answered 14 Nov '14, 07:33

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

Thank you very much for the answer. It does resolve the PNIO dissector issue, however, all frames now show FCS errors. I believe the tap or USB driver removed the VLAN(0) tag QOS/TOS bits and therfore the checksum is incorrect. I will investigate further.

(14 Nov '14, 10:34) mark_w1
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×16
×3

question asked: 14 Nov '14, 07:26

question was seen: 1,581 times

last updated: 14 Nov '14, 10:34

p​o​w​e​r​e​d by O​S​Q​A