Wireshark · Ethereal-users: Re: [Ethereal-users] physical errors

[Guy Harris <guy@xxxxxxxxxx>]

> i am developing a survey about protocol analyzers. Your help would be
> really apreciated. I would like to know if Ethereal can capture even
> physical errors (like CRC errors and collisions)?

Ethereal can capture only what the packet capture mechanism it uses
allows it to capture.

> By utilizing a special network  adapter, sniffer can do that. What about
> Ethereal?

Unlike some commercial packet analyzers for Windows, Ethereal doesn't
provide its own drivers for network adapters (and almost certainly never
will do so) - it relies on the driver in the OS on which it's running to
do the work.

Some network interfaces can be configured to capture packets with
errors.  Some drivers on some OSes may, under some circumstances,
configure the card to capture those packets.  For example, one of the
FreeBSD drives for Intel networking interfaces does that if told to go
into promiscuous mode; however, the BPF mechanism in BSD doesn't have
any way to indicate whether the packet in question *had* a CRC error.