Hi, We are facing an issue in our network. To debug this issue when we decided to do a capture using wireshark, the capture shows some frames with "Frame check sequence: 0xa78b22ce [incorrect, should be 0x56e60339]". The wireshark version that this is seen on was 1.0.4. Then I upgraded to the latest version of wireshark, i.e. 1.6.0. And this same trace does not show this FCS incorrect anymore. It only says "Trailer: a78b22ce". So now I am confused if the previous wireshark was actually showing us an FCS error or not? Which wireshark is showing the right information? This question is marked "community wiki". asked 18 Jul '11, 02:10  ws_user |
One Answer:
You might need to enable "Assume frames have FCS" in the Ethernet protocol preferences. BTW (as a personal interest) what NIC / Capture hardware have you used that passes the FCS to Wireshark? answered 18 Jul '11, 02:23  SYN-bit ♦♦ |
I have tried with both "Assume frames have FCS" enabled as well as disabled on the newer version (1.6.0) in both cases I get the same result i.e. frame only shows "Trailer: a78b22ce". On new version it never says as FCS incorrect or anything. The old version does not have that option under preferences / protocol / ethernet! I was using Dell laptop E6400 with Broadcom netextreme gige NIC, the setup was a port mirrored cisco router and laptop connected to mirrored port. Not every frame shows to be carrying FCS / trailer only some frames have it out of which in problem situation older version is showing 90% having this FCS incorrect thing. The cisco'c CRC counter is always 0!!
FYI, I converted your answer to a comment to keep the Q&A nature of this forum.
Can you tell if the FCS maybe only exists for outgoing frames?
Hi, FCS incorrect is seen on both inbound and outbound frames for the routers! What confuses me is that the FCS actually does not change for inbound and outbound frame. Which I think it should. Also if the router encountered an CRC error it will drop the frame and update the counter, which it is not doing. So my doubt regarding what WS is showing
The handling of the FCS in Ethernet frames was broken when the Ethernet dissector was changed to process VLAN tags itself. I've checked a fix into the trunk, and will schedule it to be included in 1.6.3.