This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

PNIO Dissector Incorrect When FCS in Capture

0

I am using the EtherShark tap and it delivers the Ethernet Frame Check Sum, along with the rest of the frame, to Wireshark. Wireshark dissector for PNIO messages incorrectly assumes that the FCS is part of the Profinet data resulting in the following errors: 1) Cycle number incorrectly identified as the first 2 bytes of the FCS 2) Data Status incorrectly identified as byte 3 of FCS 3) Transfer Status incorrectly identified as byte 4 of FCS 4) Profinet IO Cyclic Service Data Unit length bloated by 4 bytes 5) User Data (including GAP and RTCPadding) bloated by 4 bytes.

Other profinet messages seem unaffected, although I have not studied other message types in great detail as of yet.

I tried using editcap to remove the last 4 bytes but this did not work as the dissectors recognized the bytes were missing.

How can I work around this problem??

asked 14 Nov '14, 07:26

mark_w1's gravatar image

mark_w1
15113
accept rate: 0%


One Answer:

0

Have you tried setting the preferences for the Ethernet dissector to "Assume packets have FCS"?

answered 14 Nov '14, 07:33

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

Thank you very much for the answer. It does resolve the PNIO dissector issue, however, all frames now show FCS errors. I believe the tap or USB driver removed the VLAN(0) tag QOS/TOS bits and therfore the checksum is incorrect. I will investigate further.

(14 Nov '14, 10:34) mark_w1