This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am trying to analysis EtherCAT packet using WireShark.

I could capture EtherCAT packet and the data looks no problem.

But, when the EtherCAT packet was destroyed by some reaseon, e.g. noise or cable broken,

Can I detect the pacekt was destroyed or not?

I can not find any filter to detect disturbed EtherCAT signal.

In addition to, How can I detect some EtherCAT packet is loss or not?

asked 04 Jan '16, 22:41

hetero98's gravatar image

hetero98
6113
accept rate: 0%

1

I think there are two parts to your question -

To detect loss, I think you can do a timing analysis. EtherCAT network may produce frames on a given interval (well, never used this protocol but google says process data is cyclic...) so a missing frame will show in the timing. If data is pushed out at a given interval, a lost frame will show as 2x the interval timing. Good display filters and a delta_time column can help with this.

To actually see the bad frame, you likely need some special hardware. Hilscher makes analysis cards for things like this, but for those challenged to get funding for such equipment, certain Intel NICs have a Linux driver that will pass up all frames, including bad ones, AND which have the CRC intact. These are readable in Wireshark, and sortable by looking at the FCS failure.

(05 Jan '16, 03:31) Bob Jones

Normally, the network adapter only gives to the upper layers of the software (including Wireshark) frames which have been received properly from the wire, i.e. without any errors detected using the CRC mechanism. You would need a dedicated capturing hardware which would break this rule and hand over all frames, even broken ones, for further processing. Plus, as Wireshark doesn't even get access to the CRC field of the frame, you would need that the capturing software would get it, evaluate it, and set "CRC error" bit in frame information of the pcapng-formatted capture file so that you could display that information in Wireshark. The pcap format doesn't have such fields, it can accommodate only packet contents, no additional information fields.

permanent link

answered 05 Jan '16, 02:56

sindy's gravatar image

sindy
6.0k4851
accept rate: 24%

edited 05 Jan '16, 02:57

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×8
×3

question asked: 04 Jan '16, 22:41

question was seen: 1,259 times

last updated: 05 Jan '16, 03:31

p​o​w​e​r​e​d by O​S​Q​A