Wireshark-users: Re: [Wireshark-users] Dropped Frames - Keepalive?
From: Hansang Bae <hbae@xxxxxxxxxx>
Date: Tue, 19 Feb 2008 22:33:24 -0500
bmcmanus wrote:
We have a RAD IPMux device which reports dropped packets (irregular, but approx. 2 to 10 every 5-20 seconds) only on one
of the ethernet switch ports.  Tech support for the device indicates that those are keepalive frames, such as SQE.
(Note: no Cisco in this network)

SQE would never leave the tranceiver so that's that. Besides, it's not like you have an external AUI transceiver lying around! W/o a cisco router, there's no keepalive (loop replies used by Cisco to make sure the path is OK - electrically speaking) so that rules that out.

[snip]

Can anyone suggest other traffic which might be dropped in this manner and which might not appear on a capture (e.g.,
protocol not enabled by default)?  The link services only SNMP and ping-based network monitoring and a StarTech
serial-over-IP link.

Keep in mind that almost all switches will not forward damaged frames, so you need to keep that in mind. I know you're using a tap, but you have to ensure that the tap is in the path reporting the dropped frames. This is obvious, but I just wanted to rule it out.



--

Thanks,
Hansang