On my PC I have an Intel Ethernet Connection I217-LM with e1000e driver. If I receive packets in Wireshark or any libpcap based tool, the received ethernet frames start with Ethernet II frame and end with the payload (so basically Layer 2 without FCS). Is there a possibility to show the full received bitstream of the ethernet adapter, so I can see preamble, SFD at beginning and FCS and inter packet gap at the end (basically Layer 1)? If not, could I achieve that by modifying the driver or is the Layer 1 -> Layer 2 conversion hardcoded in the network adapter?
1 Answer
Layer 1 signals (preamble, SFD) are stripped from the data stream by the NIC. There's no way to recover them as it's the hardware that removes them, not the driver. The FCS can be made visible by the driver with some NICs.
You can safely assume all of them were present since any captured frame required them to be received.
This ServerFault thread goes into more detail. (Wireshark uses WinPCap which is very similar to libpcap on Linux.)
