2

I am examining an Ethernet frame in Wireshark. According to the "Ethernet frame" Wikipedia article and accompanying diagrams, "A frame starts with a 7-octet preamble and 1-octet start frame delimiter (SFD)."

The article also highlights that "[the] preamble and start frame delimiter are not displayed by packet sniffing software because these bits are stripped away at OSI Layer 1 by the network interface controller before being passed on to the OSI layer 2 which is where packet sniffers collect their data."

My question is: is there a way to capture and display the entire Ethernet frame using Wireshark? If not, is it possible to achieve this without the use of additional hardware?

//synack

synack
  • 23
  • 1
  • 1
  • 4

3 Answers3

6

My question is: is there a way to capture and display the entire Ethernet frame using Wireshark?

Only if you have a network adapter that captures the entire frame and supplies it to the host, a driver for that adapter that sets up the adapter to do that, and a capture mechanism in the OS (or otherwise connected to libpcap/WinPcap) that allows that to be supplied.

I know of NO Ethernet adapters that supply the preamble and SFD.

At least some adapters might, however, supply the CRC/FCS. (The adapter on a Mac I used many years ago did; I don't think the adapters in current Macs do.) Wireshark attempts to guess whether an Ethernet packet has an FCS and, if it thinks it does, handles it as such. (I added the code to do that to Wireshark when I was using the Mac in question.)

If not, is it possible to achieve this without the use of additional hardware?

No, as the previous part of the answer suggests.

Hilscher Gesellschaft für Systemautomation mbH has a line of netAnalyzer devices that can be put into "transparent mode"; in that mode, the preamble, SFD, and FCS are all present, and Wireshark can read pcap files produced by those devices.

I think Endace's DAG cards can supply the FCS, but they can't supply the preamble or SFD, as far as I know.

eminsenay
  • 103
  • 2
0

According to Wireshark's website certain OSs have drivers that let you see more than others. It refers to the FCS but I'm not sure if that's the same as the CRC you are asking about.

http://www.wireshark.org/faq.html#q7.10

Oliver
  • 23
  • 5
0

Note that this is not true:

I know of NO Ethernet adapters that supply the preamble and SFD.

If you look at something like the Freescale P2020 SoC(and most likely all other networking hardware out there), it allows you to both see incoming preambles, change the length of the preamble, and emit custom preambles.

It might not be common in PCs, but for any "serious" network gear it seems very common. Not sure if Wireshark running on such a device is able to talk to the OS in a way to pick up the frames, maybe it is easier to just attach a raw packet sniffer to the physical network.

jakobengblom2
  • 121
  • 2