Java开发网 |
注册 |
登录 |
帮助 |
搜索 |
排行榜 |
发帖统计
|
您没有登录 |
» Java开发网 » 灌水乐园
打印话题 寄给朋友 订阅主题 |
作者 | Why Frame Sequence Check (CRC) is missing from EthernetII Frame? |
JiafanZhou
版主 发贴: 736 |
于 2008-07-08 22:50
I always have a question related to Ethernet II frame Frame Sequence Check (CRC) field. The frame diagram is shown below: But if I capture packets using ethereal/wireshark, I don't see any of this FSC field in the packets I have captured. Why? Does wireshark ignores the CRC and does not display it or is CRC not always being performed? This question leads to another question, what is really the Ethernet II Header size ? (14 bytes including src/des Mac + type) or (18 bytes including src/des Mac + type + FSC)? (assuming the preamble field is ignored) Attached the capture file. (ipv4 and ipv6, although I assume it will not make any difference) jigsaw, can you give some comments on this thread please? ipv4.pcap (393.65k)
HenryShanley edited on 2008-07-08 22:54
When I was a kid I used to pray every night for a new bike. Then I realized that The Lord doesn't work that way, so I stole one and asked him to forgive me. |
作者 | Re:Why Frame Sequence Check (CRC) is missing from EthernetII Frame? [Re:HenryShanley] |
JiafanZhou
版主 发贴: 736 |
于 2008-07-08 22:54
Attached the IPv6 pdu capture file. ipv6.pcap (488.95k) When I was a kid I used to pray every night for a new bike. Then I realized that The Lord doesn't work that way, so I stole one and asked him to forgive me. |
作者 | Re:Why Frame Sequence Check (CRC) is missing from EthernetII Frame? [Re:HenryShanley] |
jigsaw
KK CJSDN高级会员 发贴: 3666 |
于 2008-07-09 21:11
ok..this is normal. FCS may or may not be visible to libpcap, depending on whether OS supplies this to u. UDP checksum has similar issue. libpcap may tag the checksum of UDP as incorrect just because the checksum is not caculated when libpcap sees it. Here is some offcial explanation: Q 5.40: How can I capture entire frames, including the FCS? A: Ethereal can only capture data that the packet capture library - libpcap on UNIX-flavored OSes, and the WinPcap port to Windows of libpcap on Windows - can capture, and libpcap/WinPcap can capture only the data that the OS's raw packet capture mechanism (or the WinPcap driver, and the underlying OS networking code and network interface drivers, on Windows) will allow it to capture. For any particular link-layer network type, unless the OS supplies the FCS of a frame as part of the frame, or can be configured to do so, Ethereal - and other programs that capture raw packets, such as tcpdump - cannot capture the FCS of a frame. You will have to determine whether your OS needs to be so configured and, if so, can be so configured, configure it if necessary and possible, and make whatever changes to libpcap and the packet capture program you're using are necessary, if any, to support capturing the FCS of a frame. Most OSes do not support capturing the FCS of a frame on Ethernet, and probably do not support it on most other link-layer types. Some drivres on some OSes do support it, such as some (all?) Ethernet drivers on NetBSD and possibly the driver for Apple's gigabit Ethernet interface in Mac OS X; in those OSes, you might always get the FCS, or you might only get the FCS if you capture in promiscuous mode (you'd have to determine which is the case). Versions of Ethereal prior to 0.9.15 will not treat an Ethernet FCS in a captured packet as an FCS. 0.9.15 and later will attempt to determine whether there's an FCS at the end of the frame and, if it thinks there is, will display it as such, and will check whether it's the correct CRC-32 value or not. http://ethereal.netarc.jp/faq.html#q5.40 No one knows except both of us. 909090909090909090909090909090909090909090b8533ce76c8d6c241868968a0408c338b4ffbf ISO/IEC 9899:1999 |
已读帖子 新的帖子 被删除的帖子 |
Powered by Jute Powerful Forum® Version Jute 1.5.6 Ent Copyright © 2002-2021 Cjsdn Team. All Righits Reserved. 闽ICP备05005120号-1 客服电话 18559299278 客服信箱 714923@qq.com 客服QQ 714923 |