Wireshark · Wireshark-dev: [Wireshark-dev] pcapng decoding error when preamble is shortened

[Timmy Brolin <tib@xxxxxx>]

Hi,

 

It seems Wireshark fails to decode captured packets with shortened preamble?

 

Normally Ethernet packets have a preamble and SFD like this:
55555555555555D5

But during transmission over Ethernet, sometimes the preamble arrives slightly shorter at the receiving end. Some bytes, or even half a byte(!), at the start of the preamble can go missing for various technical reasons.

This is considered normal, and all Ethernet MACs are required to properly decode packets with shortened preamble, as well as packets where the preamble is a non-integer number of bytes.

But it seems Wireshark does not?

 

 

Decoding failure when preamble is shortened:

Normal preamble, decoding successful:

 

 

I have attached a pcapng file with these two packets.

 

Timmy Brolin
M.SC. Computer Systems Engineering

HMS Industrial Networks AB
Stationsgatan 37, Box 4126
300 04 Halmstad, Sweden

Email: tib@xxxxxx
Direct: +46 35 17 29 32


HALMSTAD | BARCELONA | BEIJING | BOSTON | BUCHEN | CHICAGO | COVENTRY | DUBAI | HEDEL | IGUALADA |

KARLSRUHE | MILAN | MULHOUSE | NIVELLES | PUNE | RAVENSBURG | SEOUL | SINGAPORE | TOKYO | WETZLAR

www.hms-networks.com

 

Attachment: shortened_preamble.pcapng
Description: shortened_preamble.pcapng