wireshark為什么不能抓取完整的ethernet包或者物理鏈路的包?比如以太網的CRC校驗字段(4字節)


以太網

https://serverfault.com/questions/521443/can-wireshark-capture-an-entire-ethernet-frame-including-preamble-crc-and-inter

My question is: is there a way to capture and display the entire Ethernet frame using Wireshark?

Only if you have a network adapter that captures the entire frame and supplies it to the host, a driver for that adapter that sets up the adapter to do that, and a capture mechanism in the OS (or otherwise connected to libpcap/WinPcap) that allows that to be supplied.

I know of NO Ethernet adapters that supply the preamble and SFD.

At least some adapters might, however, supply the CRC/FCS. (The adapter on a Mac I used many years ago did; I don't think the adapters in current Macs do.) Wireshark attempts to guess whether an Ethernet packet has an FCS and, if it thinks it does, handles it as such. (I added the code to do that to Wireshark when I was using the Mac in question.)

If not, is it possible to achieve this without the use of additional hardware?

No, as the previous part of the answer suggests.

Hilscher Gesellschaft für Systemautomation mbH has a line of netAnalyzer devices that can be put into "transparent mode"; in that mode, the preamble, SFD, and FCS are all present, and Wireshark can read pcap files produced by those devices.

I think Endace's DAG cards can supply the FCS, but they can't supply the preamble or SFD, as far as I know.


免責聲明!

本站轉載的文章為個人學習借鑒使用,本站對版權不負任何法律責任。如果侵犯了您的隱私權益,請聯系本站郵箱yoyou2525@163.com刪除。



 
粵ICP備18138465號   © 2018-2025 CODEPRJ.COM