I use Wireshark version 1.4.0; OS: Windows 7 details of problem: I capture UDP stream, and I definitely know, that FCS of all packets is wrong. But all packets are captured and look normally in caprure window (colored blue). Is this possible to differ packets with wrong FCS from packets with correct FCS? Thank You! asked 22 Nov '11, 00:01  Gistereziz |
One Answer:
The answer is: "It depends" :-) Normally a NIC will drop frames with an incorrect FCS so you will not see the frames at all. But even if the frames are seen by wireshark most NICs (or their drivers) will strip the FCS before passing the packets on. So wireshark will not be able to see whether the FCS was correct or not. Then in practice. I used my NetOptics tap in the timestamping mode, which basically uses the FCS field as a timestamp. To my big surprise I was able to see all packets on my ASUS laptop with Realtek NIC. My MacBook did not show any packets (as expected). I mailed Realtek whether it was possible to make the NIC/driver *not* strip the FCS, but got a negative response (well, actually I think they did not understand the purpose of my question). answered 22 Nov '11, 01:02  SYN-bit ♦♦ |
Are you sure that all packets have wrong FCS and why ?
Normally your NIC will discard every frame with incorrect Layer 2 FCS and so those would never appear in wireshark