Hi,

We are facing an issue in our network. To debug this issue when we decided to do a capture using wireshark, the capture shows some frames with "Frame check sequence: 0xa78b22ce [incorrect, should be 0x56e60339]". The wireshark version that this is seen on was 1.0.4. Then I upgraded to the latest version of wireshark, i.e. 1.6.0. And this same trace does not show this FCS incorrect anymore. It only says "Trailer: a78b22ce". So now I am confused if the previous wireshark was actually showing us an FCS error or not? Which wireshark is showing the right information?

This question is marked "community wiki".

asked 18 Jul '11, 02:10

ws_user's gravatar image

ws_user
1111
accept rate: 0%


You might need to enable "Assume frames have FCS" in the Ethernet protocol preferences.

BTW (as a personal interest) what NIC / Capture hardware have you used that passes the FCS to Wireshark?

link

answered 18 Jul '11, 02:23

SYN-bit's gravatar image

SYN-bit ♦♦
15.0k848219
accept rate: 19%

I have tried with both "Assume frames have FCS" enabled as well as disabled on the newer version (1.6.0) in both cases I get the same result i.e. frame only shows "Trailer: a78b22ce". On new version it never says as FCS incorrect or anything. The old version does not have that option under preferences / protocol / ethernet! I was using Dell laptop E6400 with Broadcom netextreme gige NIC, the setup was a port mirrored cisco router and laptop connected to mirrored port. Not every frame shows to be carrying FCS / trailer only some frames have it out of which in problem situation older version is showing 90% having this FCS incorrect thing. The cisco'c CRC counter is always 0!!

(18 Jul '11, 03:45) ws_user

FYI, I converted your answer to a comment to keep the Q&A nature of this forum.

Can you tell if the FCS maybe only exists for outgoing frames?

(18 Jul '11, 05:33) Jasper ♦

Hi, FCS incorrect is seen on both inbound and outbound frames for the routers! What confuses me is that the FCS actually does not change for inbound and outbound frame. Which I think it should. Also if the router encountered an CRC error it will drop the frame and update the counter, which it is not doing. So my doubt regarding what WS is showing

(19 Jul '11, 00:28) ws_user

The handling of the FCS in Ethernet frames was broken when the Ethernet dissector was changed to process VLAN tags itself. I've checked a fix into the trunk, and will schedule it to be included in 1.6.3.

(13 Sep '11, 14:20) Guy Harris ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×122
×13

Asked: 18 Jul '11, 02:10

Seen: 11,889 times

Last updated: 13 Sep '11, 14:20

powered by OSQA