Invisible CRC

[douglas767]

Hello to all,

People, I need your help again!
I have a area on the company with some linux "experts" and one of then show me a software named "IPTRAF". On this software we have a CRC Indicator that grow in the time.
I'm Install Sniffer (Portable 4.7) on the same link and I see the same traffic but Sniffer don't show the same information about CRC. The question is, What is wrong??

Thanks a lot for every one.

Douglas

 

[mpennac]

This has to do with Sniffer using the NDIS drivers to communicate with the Network Interface Card. NDIS will not pass frames containing bad CRCs up the protocol stack. As a result, the Sniffer cannot capture, count, or display them.

To get around this, they wrote a network interface card driver specifically for the Xircom CBE2 10/100 Cardbus card. This driver allows the Sniffer to capture frames containing CRC errors. I just picked up 12 of these cards at Fry's for $10 each. Unfortunately I think they were cleaning them out, because I cannot find anymore there...

If you are seeing CRC errors, you should check the Duplex settings on your devices. Both ends of the connection must be set to Full or both set to Auto. If you try to mix Auto and Forced Full, you will have problems.

Mike

http://www.nps-llc.com

 

[AZeemeri]

1. Indeed you need a card with a supported Sniffer driver to NOT discard error frames.
This is basically what a sniffer driver does.

2. Another remote possibility is that "IPTRAF" counts fragments as CRC's instead.
Fragments are counted if Sniffer sees frames less than 64 bytes with a bad CRC. Or is just just a mindspin too far ;-)?

 

[douglas767]

Thanks by the informations for all,
But, the company have the license for Sniffer Portable, and the sniffer card (XIRCOM CBE2)I change the xircom driver for sniffer driver. And everything works fine, I don't belive in problems with the instalation.
A friend of mine tell me about preambule errors but he don't have more informations about.

Thanks,

Douglas

 

[gdvissch]

You could probably verify the counters on your switch port. They should give a good indication if there really are errors on a specific segment...

Geert