Wireshark · Ethereal-users: [Ethereal-users] Re: corrupt frames

[ronnie sahlberg <ronniesahlberg@xxxxxxxxx>]

Ethereal does not really capture the packets, it relies on libpcap on
unix or WinPcap on windows to capture the actual packets off the wire.

If by corrupted packets you mean corrupted ethernet frames (short
frames, wrong checksum, ...) then these will be discarded by the NIC
before even pcap can see the frames so they will not show up in
ethereal. To be able to capture corrupted ethernet frames would
require specially written NIC drivers which no one has done yet.


If the ethernet frame is valid  but the content is corrupted then
Ethereal will do its best to decode as much as possible of it.



On Fri, 18 Mar 2005 12:36:06 -0600, "Nickeson, Scott T CIV N25-BRANCH"
<scott.nickeson@xxxxxxxx> wrote:
> Hello All,
> 
> I'm a new Ethereal user, so please excuse my rudimentary questions ...
> 
> How does Ethereal handle corrupt frames it encounters during capture -
> capture or drop?
> Does Ethereal report a 'corrupt frames encountered' statistic?
> 
> Thanks,
> Scott
> 
>