Wireshark · Ethereal-users: Re: [Ethereal-users] Ethereal and finding bad nics on Workstations and Servers

[Guy Harris <gharris@xxxxxxxxx>]

Hansang Bae wrote:

> No easy way of doing this. There are a few problems with this. Very
> few drivers pass up damaged frames to the application. This is why
> Network General only supports a limited number of NICs (custom drivers
> are required to circumvent NDIS' default behavior).

...and WinPcap connects to the drivers through NDIS, so it's limited by 
what NDIS offers (and by what the drivers offer, which normally doesn't 
include supplying damaged frames, although I *guess* if an NDIS client 
requests promiscuous mode on its connection to NDIS the driver *could* 
supply damaged frames - the FreeBSD Intel eepro100 driver does that for 
frames with bad CRCs - but there's no mechanism to get the error status 
from the frame from NDIS, so the NDIS client wouldn't know what the 
problem was with the frame).