This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I use Wireshark version 1.4.0; OS: Windows 7

details of problem: I capture UDP stream, and I definitely know, that FCS of all packets is wrong. But all packets are captured and look normally in caprure window (colored blue). Is this possible to differ packets with wrong FCS from packets with correct FCS?

Thank You!

asked 22 Nov '11, 00:01

Gistereziz's gravatar image

Gistereziz
1223
accept rate: 0%

Are you sure that all packets have wrong FCS and why ?

Normally your NIC will discard every frame with incorrect Layer 2 FCS and so those would never appear in wireshark

(22 Nov '11, 00:54) Landi

The answer is: "It depends" :-)

Normally a NIC will drop frames with an incorrect FCS so you will not see the frames at all. But even if the frames are seen by wireshark most NICs (or their drivers) will strip the FCS before passing the packets on. So wireshark will not be able to see whether the FCS was correct or not.

Then in practice. I used my NetOptics tap in the timestamping mode, which basically uses the FCS field as a timestamp. To my big surprise I was able to see all packets on my ASUS laptop with Realtek NIC. My MacBook did not show any packets (as expected).

I mailed Realtek whether it was possible to make the NIC/driver *not* strip the FCS, but got a negative response (well, actually I think they did not understand the purpose of my question).

permanent link

answered 22 Nov '11, 01:02

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×166
×16

question asked: 22 Nov '11, 00:01

question was seen: 4,139 times

last updated: 22 Nov '11, 01:02

p​o​w​e​r​e​d by O​S​Q​A