Re: [Ethereal-users] Spotting a bad nic?

[Guy Harris <guy@xxxxxxxxxxxx>]

On Sun, Feb 01, 2004 at 07:10:21PM -0500, Tom Greaser wrote:
> If ethreal does allow you to caputure bad frames

Ethereal allows you to capture what the underlying OS capture mechanism
allows you to capture (Ethereal includes no capture mechanism of its
own, it relies on the mechanisms that libpcap uses).

> then you should see crc errors on the frame..

...except that those capture mechanisms don't supply a "bad CRC"
indication up to libpcap, which is thus unable to supply it to tcpdump
or Ethereal or any other packet capture program.

> Your problem is probably up the stack.. layer 3 or 4

That'd be my guess *if* all the machines on the network are running
similar OSes and *if* transferring data on the network involves sending
a broadcast or possibly multicast packet - it might be that such a
packet is locking up the machines that receive it.

If it's a "Windows Me network", it might be that something's sending out
a broadcast packet that happens to lock up Windows Me.  It might be
interesting to add a machine *not* running Windows Me to the network and
see whether *it* locks up.

If that's the case, then

	1) it would probably be a good idea to have the machine running
	   Ethereal run something other than Windows Me;

	2) Ethereal would probably be able to capture the packet;

	3) figuring out which packet that is might be harder.