Comment # 2
on bug 11597
from Alfredo Quintero
(In reply to Guy Harris from comment #1)
> Heuristics can't always get it right; without an explicit indication in a
> capture file of whether an Ethernet frame contains an FCS, Wireshark has to
> guess, and its guess can be wrong if somebody does something legal but not
> obviously useful, such as padding an Ethernet frame to 68 bytes, rather than
> 64 bytes, counting the FCS, i.e. padding it to 64 bytes, rather than 60
> bytes, not counting the FCS.
>
> There's not much we can do about this without the OS providing a mechanism
> by which a device driver can indicate whether the packet data it's supply to
> the OS includes the FCS and without drivers that use that mechanism. Sadly,
> most if not all OSes don't have such a mechanism for Ethernet.
>
> Unfortunately, there's no "assume packets *don't* have FCS" setting for
> Ethernet, so we may need to make that a tri-state option (assume they do,
> assume they don't, use the heuristic).
>
> I'll have to think about the heuristic a bit more to see whether it could
> figure out, in this case, that there's no FCS, without breaking other cases.
Thanks very much for this answer.
You are receiving this mail because:
- You are watching all bug changes.