Wireshark-users: Re: [Wireshark-users] [Ethereal-users] Capturing frames greater than 1500 bytes

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 14 Aug 2006 03:30:11 -0700
Tridib Roy Chowdhury wrote:
The Ethereal project is being continued at a new site.  Please go to
http://www.wireshark.org and subscribe to wireshark-users@xxxxxxxxxxxxx.
Don't forget to unsubscribe from this list at



We have developed a custom application over ethernet link where we have only two nodes on the network transferring data between each other. The application uses frame sizes upto 4096 bytes in one ethernet frame. This is possible because the MAC engine allows us to communicate with that frame size. We are using ethereal for capturing the frames less than 1500 bytes in size, but as soon as the frame size exceeds 1500 bytes, we cant receive frames any more.

Please suggest us how we can configure / modify ethereal for receiving frames greater than 1500 bytes ?

Ethereal doesn't care how big the frames are - and neither does Wireshark (on which all future development is being done, so I'm redirecting this to the Wireshark mailing list). For that matter, on most if not all platforms, neither does libpcap/WinPcap.

I.e., if you can't receive frames bigger than 1500 bytes, that's probably a driver problem. Can the driver for the network adapter, on the machine on which you're running Ethereal, receive those frames at all? I.e., if you run Ethereal (or Wireshark) on one of the two nodes on the network, does the application in question see the larger-than-1500-byte frames?

If so, what mechanism is the application using to receive those frames?

If not, you need to get the driver changed to fix *that* problem; once that's fixed, see whether Ethereal or Wireshark works.