This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

We would like to have a foolproof method of detecting pause frames.

Now we knwo this is problematic because most mirror port switches terminate Pause frames as do most detecting NIC's.

However we have network tap so the switch issue is not a problem, the question is how do we get the Pause frame past the detecting NIC?

Because of security issues, we would like to do this on a independent network, so are there any USB ethernet adaptors that can be adapted to pass pause frames through? In fact what is the best USB ethernet adapter for use with Wireshark

asked 07 Oct '16, 02:04

hammarbytp's gravatar image

hammarbytp
6112
accept rate: 0%


I have used this to collect pause frames in the past:

http://www.hilscher.com/en/products/product-groups/analysis-and-data-acquisition/ethernet-analysis/nanl-b500g-re/

This stores the captures in memory and then you download, so the problem you have identified does not exist. Another option that I have used that addresses your specific issue is to use certain Intel chipsets on Linux (newer kernels, I forget the cut-in date). They have some options to allow passing up the FCS and all received frames. To show options:

ethtool -k <interface>

Where I would set the featurs:

rx-fcs: off [fixed]

rx-all: off

I can't find a trace to prove that I did it, but I recall that it worked. If you run into trouble I can set it up again.

permanent link

answered 07 Oct '16, 06:28

Bob%20Jones's gravatar image

Bob Jones
1.0k2515
accept rate: 21%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×69
×41
×3

question asked: 07 Oct '16, 02:04

question was seen: 1,275 times

last updated: 07 Oct '16, 06:28

p​o​w​e​r​e​d by O​S​Q​A