Wireshark-dev: [Wireshark-dev] pcapng decoding error when preamble is shortened
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Timmy Brolin <tib@xxxxxx>
Date: Tue, 9 Feb 2021 10:21:39 +0000

Hi,

 

It seems Wireshark fails to decode captured packets with shortened preamble?

 

Normally Ethernet packets have a preamble and SFD like this:
55555555555555D5

But during transmission over Ethernet, sometimes the preamble arrives slightly shorter at the receiving end. Some bytes, or even half a byte(!), at the start of the preamble can go missing for various technical reasons.

This is considered normal, and all Ethernet MACs are required to properly decode packets with shortened preamble, as well as packets where the preamble is a non-integer number of bytes.


But it seems Wireshark does not?

 

 

Decoding failure when preamble is shortened:



Normal preamble, decoding successful:

 

 

I have attached a pcapng file with these two packets.

 

Timmy Brolin
M.SC. Computer Systems Engineering


HMS Industrial Networks AB
Stationsgatan 37, Box 4126
300 04 Halmstad, Sweden

Email: tib@xxxxxx
Direct: +46 35 17 29 32


HALMSTAD | BARCELONA | BEIJING | BOSTON | BUCHEN | CHICAGO | COVENTRY | DUBAI | HEDEL | IGUALADA |

KARLSRUHE | MILAN | MULHOUSE | NIVELLES | PUNE | RAVENSBURG | SEOUL | SINGAPORE | TOKYO | WETZLAR

www.hms-networks.com

 

Attachment: shortened_preamble.pcapng
Description: shortened_preamble.pcapng