This is a static archive of our old Q&A Site. Please post any new questions and answers at

Preamble frame capture


Is it possible to configure wireshark to capture also the preamble and the SFD bytes of a ethernet frame? If affirmative, how to do this capture?

Best regards

asked 25 Oct '10, 07:04

kzxc's gravatar image

accept rate: 0%

Apparantly not.
See the Wireshark Wiki: Ethernet -> Packet format.

(25 Oct '10, 07:54) joke

Nope - but I wonder... why do you need to capture the preamble/SFD? Interesting question.

(25 Oct '10, 09:03) lchappell ♦

I have some old Sniffer boards around here somewhere... clearing off cobwebs in a rarely-visited corner of the office...

(25 Oct '10, 20:38) lchappell ♦

One Answer:


You'd probably need specialized hardware to capture the preamble and SFD; I think most Ethernet adapters will not provide that to the host, no matter how politely the adapter's driver would like to ask it. :-) I don't know what hardware is available to capture that.

answered 25 Oct '10, 19:12

Guy%20Harris's gravatar image

Guy Harris ♦♦
accept rate: 19%