Wireshark · Ethereal-users: Re: [Ethereal-users] newbie-how ethereal captures packet?

[Guy Harris <gharris@xxxxxxxxx>]

cranium2003 wrote:

>     I want to ask does ethereal captures all frames(i
> think rather packets ethereal captures frames right?)
> including frame with errors and correct frames? 

Ethereal captures packets by calling libpcap routines.

Libpcap captures packets by using various different mechanisms on 
various different OSes.  In almost all of those cases, those mechanisms 
will *NOT* capture link-layer packets (frames) with errors.

Some drivers on some OSes *might* supply those packets, but I don't know 
which, if any, drivers do.

>      Then will Linux os ifconfig command will also
> make entry in its analysis that packet is dropped?

That probably depends on the driver.