We would like to have a foolproof method of detecting pause frames. Now we knwo this is problematic because most mirror port switches terminate Pause frames as do most detecting NIC's. However we have network tap so the switch issue is not a problem, the question is how do we get the Pause frame past the detecting NIC? Because of security issues, we would like to do this on a independent network, so are there any USB ethernet adaptors that can be adapted to pass pause frames through? In fact what is the best USB ethernet adapter for use with Wireshark asked 07 Oct '16, 02:04  hammarbytp |
One Answer:
I have used this to collect pause frames in the past: This stores the captures in memory and then you download, so the problem you have identified does not exist. Another option that I have used that addresses your specific issue is to use certain Intel chipsets on Linux (newer kernels, I forget the cut-in date). They have some options to allow passing up the FCS and all received frames. To show options: ethtool -k <interface> Where I would set the featurs: rx-fcs: off [fixed] rx-all: off I can't find a trace to prove that I did it, but I recall that it worked. If you run into trouble I can set it up again. answered 07 Oct '16, 06:28  Bob Jones |
