Guy Harris
changed
bug 11597
| What |
Removed |
Added |
| Status |
UNCONFIRMED
|
CONFIRMED
|
| Hardware |
x86
|
All
|
| Summary |
ETHERNET FCS INCORRECT flagged incorrectly for [ACK] and [SYN, ACK] frames from Melsec QJ71E71-100
|
No way to disable FCS for captured Ethernet packets, in case the heuristic can't get the right answer
|
| Ever confirmed |
|
1
|
| OS |
Windows 7
|
All
|
Comment # 1
on bug 11597
from Guy Harris
Heuristics can't always get it right; without an explicit indication in a
capture file of whether an Ethernet frame contains an FCS, Wireshark has to
guess, and its guess can be wrong if somebody does something legal but not
obviously useful, such as padding an Ethernet frame to 68 bytes, rather than 64
bytes, counting the FCS, i.e. padding it to 64 bytes, rather than 60 bytes, not
counting the FCS.
There's not much we can do about this without the OS providing a mechanism by
which a device driver can indicate whether the packet data it's supply to the
OS includes the FCS and without drivers that use that mechanism. Sadly, most
if not all OSes don't have such a mechanism for Ethernet.
Unfortunately, there's no "assume packets *don't* have FCS" setting for
Ethernet, so we may need to make that a tri-state option (assume they do,
assume they don't, use the heuristic).
I'll have to think about the heuristic a bit more to see whether it could
figure out, in this case, that there's no FCS, without breaking other cases.
You are receiving this mail because:
- You are watching all bug changes.