Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Low level analyzer

From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Wed, 6 Mar 2019 18:49:32 +0100
> On 6 Mar 2019, at 08:39, Helge Kruse <Helge.Kruse@xxxxxxx> wrote:
> 
> I use Wireshark for analyzing the network traffic. I identified a lot
> of re-transmissions caused by packet loss on a device that is
> connected to a 10 MBit/s hub or switch. If the same device is
> connected to a 100 MBit/s switch, it works normally.
> 

The question may be: is there a speed mismatch, or other link parameter.

> Wireshark uses a packet capture library (e.g. Winpcap for Windows)
> that captures all packets visible to the network controller driver.
> But there is also the low level communication that is responsible to
> perform the speed and mode negotiation between hub and PHY (and
> probably between PHY and MAC controller).

These negotiations take place between the PHY’s, the MAC controller (or rather the CPU) sets parameters and retrieves link status and other reports.

> 
> Do you know any tool that can be used to investigate what's going on
> here? It would be sufficient to look at the 10 MBit/s connection. Is
> there any documentation or guide line how to attack such a problem?

You suspect something is wrong with the link negotiations? The problem here is that you still need to know about the configuration and state of the PHY’s. When everything is set to ‘autoneg', it should be fine, but setting one end (e.g., your device) to 'fixed' and problems like this occur.
If you want to have a test partner for your switch port and device you can use a Linux machine with a decent network card as well. ethtool is your friend here, allowing you to set PHY parameters and then plug it in to see what link is negotiated.

Thanks,
Jaap