wireshark为什么不能抓取完整的ethernet包或者物理链路的包？比如以太网的CRC校验字段（4字节）...

wireshark为什么不能抓取完整的ethernet包或者物理链路的包？比如以太网的CRC校验字段（4字节）

以太网

https://serverfault.com/questions/521443/can-wireshark-capture-an-entire-ethernet-frame-including-preamble-crc-and-inter

My question is: is there a way to capture and display the entire Ethernet frame using Wireshark?

Only if you have a network adapter that captures the entire frame and supplies it to the host, a driver for that adapter that sets up the adapter to do that, and a capture mechanism in the OS (or otherwise connected to libpcap/WinPcap) that allows that to be supplied.

I know of NO Ethernet adapters that supply the preamble and SFD.

At least some adapters might, however, supply the CRC/FCS. (The adapter on a Mac I used many years ago did; I don't think the adapters in current Macs do.) Wireshark attempts to guess whether an Ethernet packet has an FCS and, if it thinks it does, handles it as such. (I added the code to do that to Wireshark when I was using the Mac in question.)

If not, is it possible to achieve this without the use of additional hardware?

No, as the previous part of the answer suggests.

Hilscher Gesellschaft für Systemautomation mbH has a line of netAnalyzer devices that can be put into "transparent mode"; in that mode, the preamble, SFD, and FCS are all present, and Wireshark can read pcap files produced by those devices.

I think Endace's DAG cards can supply the FCS, but they can't supply the preamble or SFD, as far as I know.

posted on 2018-05-25 15:08  乌龙院院长 阅读( ...) 评论( ...) 编辑 收藏

转载于:https://www.cnblogs.com/wlyyz/p/9088707.html