Wireshark-bugs: [Wireshark-bugs] [Bug 11597] No way to disable FCS for captured Ethernet packets
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Fri, 16 Oct 2015 03:07:22 +0000

changed bug 11597


What Removed Added
Status UNCONFIRMED CONFIRMED
Hardware x86 All
Summary ETHERNET FCS INCORRECT flagged incorrectly for [ACK] and [SYN, ACK] frames from Melsec QJ71E71-100 No way to disable FCS for captured Ethernet packets, in case the heuristic can't get the right answer
Ever confirmed   1
OS Windows 7 All

Comment # 1 on bug 11597 from 
Heuristics can't always get it right; without an explicit indication in a
capture file of whether an Ethernet frame contains an FCS, Wireshark has to
guess, and its guess can be wrong if somebody does something legal but not
obviously useful, such as padding an Ethernet frame to 68 bytes, rather than 64
bytes, counting the FCS, i.e. padding it to 64 bytes, rather than 60 bytes, not
counting the FCS.

There's not much we can do about this without the OS providing a mechanism by
which a device driver can indicate whether the packet data it's supply to the
OS includes the FCS and without drivers that use that mechanism.  Sadly, most
if not all OSes don't have such a mechanism for Ethernet.

Unfortunately, there's no "assume packets *don't* have FCS" setting for
Ethernet, so we may need to make that a tri-state option (assume they do,
assume they don't, use the heuristic).

I'll have to think about the heuristic a bit more to see whether it could
figure out, in this case, that there's no FCS, without breaking other cases.

You are receiving this mail because:
  • You are watching all bug changes.