Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Are the Ethernet frame checksums even visible to Wireshark, which hooks into the IP layer? would some of the ethernet stuff be only visible within the ethernet card itself, not to the software stack?


Sometimes they are. It depends on how the capture was generated. If you look in the options of Wireshark there is one to detect bad checksums, so clearly there is a way to capture them. Here is one such way: https://stackoverflow.com/questions/22101650/how-can-i-recei...

This can be used to detect partially-bad network cables, because there is no reason you should ever receive a bad FCS.


Wireshark has support for lots of interfaces, it's just a consumer for OS/driver supplied data in this aspect.

See eg this bit about wlan for some of the complexity: https://wiki.wireshark.org/CaptureSetup/WLAN#link-layer-radi...


Wireshark works at the data link layer (L2).


Well...

ethhdr only has 14 bytes: 6 for dest mac address, 6 for source mac address, 2 for ethertype (e.g. IPv4 vs IPv6).

Any bad checksums that Wireshark can detect are predominantly at the transport layer (L4; TCP / UDP).

You'd have to explicitly turn on FCS, which I don't know if you can even do on, say, Windows.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: