Ethereal-users: Re: [Ethereal-users] capturing retransmitted package from data-link layer
vinh.pham@xxxxxx wrote:
Suppose I send data traffic through wireless interface (UDP package)
from PC A to PC B.
When there are collisions on the link, or the link is unstable, some
package will be lost and need to
be restransmitted. As far as I know this will be taken care of by the
data link layer/ethernet layer.
>
The question is whether ethereal can capture these retransmitted package
as well?
If you're running Ethereal on PC A, it will be supplied with a copy of a
packet sent from PC A to PC B *before* that packet handed to the
adapter; that copy will be done in software, and, as it's done *before*
the packet is handed to the adapter, you won't see any retransmissions
as the code that makes the copy doesn't know the retransmissions are
being done.
If you're running Ethereal on PC B, PC B's wireless adapter is probably
not running in "monitor mode" or "rfmon mode", if "wireless" means
802.11. At least on most OSes, if the adapter is in "monitor mode" it
can't act like a regular network adapter. Therefore, the adapter will
only supply to the host packets it successfully receives, and will
probably discard any retransmissions of successfully-received packets.
If the packet *wasn't* successfully received, the *original*
transmission won't be supplied to Ethereal by the wireless adapter; if
the retransmission is successfully recieved, that will be supplied.
If you're running Ethereal on some other machine, its adapter is
presumably either in promiscuous mode or monitor mode. In that case,
it'll supply to Ethereal whatever packets it accepts in that mode. I
don't know whether it'll successfully receive and accept the initial
packet that got the collision; the collision might cause it not to be
received. If the retransmission is successfully received and accepted,
it will be supplied to Ethereal.
In other words, on any machine *other* than PC A, Ethereal will probably
capture the retransmitted packet - but it won't capture it "as well", as
it probably *won't* capture the *original* packet if it was damaged by a
collision! On PC A (i.e., on the machine that transmitted the packet),
you'll just get a software copy of the packet, before it's even
transmitted for the first time.
If not, is there any tool that can do that?
You can probably replace "Ethereal" with any other tool in the above,
and it will still be true.
