Wireshark-users: Re: [Wireshark-users] Question regarding oversized frames

From: "Grant Mills" <gmills@xxxxxxxx>
Date: Tue, 5 Sep 2006 15:56:33 -0700

On 9/5/06, Grant Mills <gmills@xxxxxxxx> wrote:

I'm trying to view some packets generated by a SmartBits.

I generate a 1514 byte frame on the Smart Bits.  This goes out and
ethereal displays it.  The device on the other end, loops it back
(Swaps Src & Dest MAC & IP Addrs.)  The SmartBits capture tools
receives and displays the frame.  Wireshark does not display the
packet.  There is one slight modification to frame.  Due to a hardware
limitation on the DUT, the return frame is now 1516 bytes (not
including CRC.)  We're forced to use 4 byte alignment on our transmit.
 So the returned frame is now over sized.  I have witnessed v0.10.7 of
Ethereal displaying frames of this size, but 0.10.10 does not.  I
tried WireShark 0.99.3 and it doesn't display the over sized frames
either.

I'm about to go research pcap/tcpdump to see if the problem lies there.

I really need to either configure Ethereal/WireShark/Pcap to display
these over sized frames or find a tool that does.

One last possibility is that the packets are getting dropped by the
driver or hardware.  If this were the case, can any body suggest a
method to test this?

Any help will be appreciated.  Thanks in advance.

While I was able to determine that 0.10.7 does indeed display the
frames, I also determined that the problem does not exist there.  I
installed 0.10.7 with a different version of winpcap and did not see
the oversized frames.  My journey just took a dive into either
winpcap, the driver or the NIC hardware.

I'm continuing to investigate, but would like a shove in the right direction.

Thanks in advance.



--
Grant Mills
gmills@xxxxxxxx