3 ms·
Are the Ethernet frame checksums even visible to Wireshark, which hooks into the IP layer? would some of the ethernet stuff be only visible within the ethernet
by AceJohnny2 3y ago
Are the Ethernet frame checksums even visible to Wireshark, which hooks into the IP layer? would some of the ethernet stuff be only visible within the ethernet card itself, not to the software stack?
- jzwinck 3y agoSometimes they are. It depends on how the capture was generated. If you look in the options of Wireshark there is one to detect bad checksums, so clearly there is a way to capture them. Here is one such way: https://stackoverflow.com/questions/22101650/how-can-i-receive-the-wrong-ethernet-frames-and-disable-the-crc-fcs-calcul https://stackoverflow.com/questions/22101650/how-can-i-recei... This can be used to detect partially-bad network cables, because there is no reason you should ever receive a bad FCS.
- thelittleone 3y agoWireshark works at the data link layer (L2).
- vitus 3y agoWell... ethhdr only has 14 bytes: 6 for dest mac address, 6 for source mac address, 2 for ethertype (e.g. IPv4 vs IPv6). Any bad checksums that Wireshark can detect are predominantly at the transport layer (L4; TCP / UDP). You'd have to explicitly turn on FCS, which I don't know if you can even do on, say, Windows.
- fulafel 3y agoWireshark has support for lots of interfaces, it's just a consumer for OS/driver supplied data in this aspect. See eg this bit about wlan for some of the complexity: https://wiki.wireshark.org/CaptureSetup/WLAN#link-layer-radio-packet-headers https://wiki.wireshark.org/CaptureSetup/WLAN#link-layer-radi...