3

I turned on the calculatin of the FCS Checksum in wireshark. There wasn't a single correct checksum in the whole 500MB packet dump. I asume the reason for this is that the field is simply not used for this puprose but instead is used for the payload. Is this assumption correct and if so why isn't the FCS utilized?

3
  • 3
    Your assumption is incorrect. The problem is in the way your NIC processes the packets before it reaches Wireshark. – Ron Trunk Nov 2 '17 at 12:51
  • This means wireshark doesn't see the frames because they have already been removed by my NIC? – davidb Nov 2 '17 at 13:03
  • 3
    This link on the Wireshark site might help you: osqa-ask.wireshark.org/questions/30702/… – Ron Trunk Nov 2 '17 at 13:21
3

In the original old fashioned 10Mb/s Ethernet, you could usually ask the NIC driver to deliver packets to you, even if the checksum was incorrect. You might then be able to identify a problematic host and take corrective action.

Since then:

  1. Multidrop networks have been replaced with switched networks, which generally do not forward packets with bad checksums.
  2. Ethernet hardware has become much more integrated and reliable, making it rarer to need such low level troubleshooting. It pretty much 'just works', or gets thrown away.
  3. Physical layer encodings have become more complex, making a NIC a much less useful tool if you need to troubleshoot at that level.

For all these reasons, it's much less common for modern NIC drivers and hardware to allow you to capture packets with bad checksums. If it does, it would have to be enabled with -rx-fcs and -rx-all in ethtool or equivalent.

Generally though, forget about it, because of 1. above.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.