On Tue, Feb 13, 2001 at 10:03:45AM -0600, Vivek Telang wrote:
> I'm using Ethereal on a Windows2000 machine with an Intel Pro100 adapter card.
>
> My question is : how can I use Ethereal to detect IP packets with CRC errors?
Presumably you mean "Ethernet packets with CRC errors", or "IP packets
with checksum errors" - IP doesn't have a CRC, it just has a checksum,
but the Ethernet packet in which an IP datagram is carried *does* have a
CRC.
Ethereal does check the checksum on the IP header (and a number of other
IP checksums).
However, unless the packet-capture mechanism, and network card driver,
on the OS on which you're running supplies to programs doing network
captures the contents of packets with CRC errors (rather than just
silently discarding those packets as bad packets), or the driver can be
configured by the packet-capture mechanism to supply those packets to
it, Ethereal won't ever see those packets.
It also would either
1) have to get an indication from the packet capture mechanism
that the packet being supplied to it has a CRC error
or
2) have to get the CRC as part of the packet contents (and an
indication that this has been done, so it knows that the last
4 bytes of the packet are a CRC, not padding)
and, in the latter case, would have to have code to check the CRC.
As far as I know, neither WinPcap, the packet capture mechanism used by
Ethereal on Windows, nor...
> Also, would it be faster/easier to do this with Ethereal on a linux machine?
...the Linux packet-socket packet capture mechanism support capturing
packets that the network card would normally discard due to the card
having a bad CRC, so Ethereal will not ever see any packets with bad CRCs
on either of those systems - or, for that matter, on BSD or, as far as I
know, any of the other platforms it supports. Furthermore, without help
from the packet-capture mechanism, there's nothing it *can* do to see
those packets.