I turned on the calculatin of the FCS Checksum in wireshark. There wasn't a single correct checksum in the whole 500MB packet dump. I asume the reason for this is that the field is simply not used for this puprose but instead is used for the payload. Is this assumption correct and if so why isn't the FCS utilized?
3
-
3Your assumption is incorrect. The problem is in the way your NIC processes the packets before it reaches Wireshark.– Ron TrunkNov 2, 2017 at 12:51
-
This means wireshark doesn't see the frames because they have already been removed by my NIC?– davidbNov 2, 2017 at 13:03
-
3This link on the Wireshark site might help you: osqa-ask.wireshark.org/questions/30702/…– Ron TrunkNov 2, 2017 at 13:21
Add a comment
|
1 Answer
In the original old fashioned 10Mb/s Ethernet, you could usually ask the NIC driver to deliver packets to you, even if the checksum was incorrect. You might then be able to identify a problematic host and take corrective action.
Since then:
- Multidrop networks have been replaced with switched networks, which generally do not forward packets with bad checksums.
- Ethernet hardware has become much more integrated and reliable, making it rarer to need such low level troubleshooting. It pretty much 'just works', or gets thrown away.
- Physical layer encodings have become more complex, making a NIC a much less useful tool if you need to troubleshoot at that level.
For all these reasons, it's much less common for modern NIC drivers and hardware to allow you to capture packets with bad checksums. If it does, it would have to be enabled with -rx-fcs and -rx-all in ethtool or equivalent.
Generally though, forget about it, because of 1. above.
