Ethereal-users: Re: [Ethereal-users] Sniffine Ethernet frames with CRC errors?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Wed, 11 Dec 2002 22:00:56 -0800
On Wed, Dec 11, 2002 at 09:48:27PM -0800, Sudarshan Vasudevan wrote:
> Does Ethereal permit to sniff all Ethernet frames
> including the ones with CRC errors? Or do I have to
> make changes to my network driver and kernel to help
> me do that?

	http://www.ethereal.com/faq.html#q5.23

> If I do have to make changes, does anyone have an idea
> as to what are the steps involved?

I don't.  It depends on the driver - and the OS; for example, the BSDs
use a mechanism separate from the networking stack to supply captured
packets to sniffing programs, so it'd be OK to supply packets with CRC
errors to BPF, as they won't be seen by the networking stack, but most
other OSes (Linux, systems using DLPI such as Solaris, Windows plus
WinPcap) use networking stack mechanisms to do that, so you'd somehow
have to figure out how to keep the networking stack from seeing those
packets, *IF* that's even possible.