I am trying to analysis EtherCAT packet using WireShark. I could capture EtherCAT packet and the data looks no problem. But, when the EtherCAT packet was destroyed by some reaseon, e.g. noise or cable broken, Can I detect the pacekt was destroyed or not? I can not find any filter to detect disturbed EtherCAT signal. In addition to, How can I detect some EtherCAT packet is loss or not? asked 04 Jan '16, 22:41  hetero98 |
One Answer:
Normally, the network adapter only gives to the upper layers of the software (including Wireshark) frames which have been received properly from the wire, i.e. without any errors detected using the CRC mechanism. You would need a dedicated capturing hardware which would break this rule and hand over all frames, even broken ones, for further processing. Plus, as Wireshark doesn't even get access to the CRC field of the frame, you would need that the capturing software would get it, evaluate it, and set "CRC error" bit in frame information of the pcapng-formatted capture file so that you could display that information in Wireshark. The pcap format doesn't have such fields, it can accommodate only packet contents, no additional information fields. answered 05 Jan '16, 02:56  sindy edited 05 Jan '16, 02:57 |
I think there are two parts to your question -
To detect loss, I think you can do a timing analysis. EtherCAT network may produce frames on a given interval (well, never used this protocol but google says process data is cyclic...) so a missing frame will show in the timing. If data is pushed out at a given interval, a lost frame will show as 2x the interval timing. Good display filters and a delta_time column can help with this.
To actually see the bad frame, you likely need some special hardware. Hilscher makes analysis cards for things like this, but for those challenged to get funding for such equipment, certain Intel NICs have a Linux driver that will pass up all frames, including bad ones, AND which have the CRC intact. These are readable in Wireshark, and sortable by looking at the FCS failure.