8

I generate a traffic between two PCs running Linux (by sending Ethernet frames), the goal of this is to capture some errors frames. The problem is when the Phy layer detect an error on a frame (if the CRC or FCS is not valid) the frame is dropped and I can't receive it in my program.

Are the any way to receive the wrong frame (disable the drops in the Phy layer and receiving a indicator that indicate that this frame is wrong for example) and how can i consult the statistic of the NIC card (number of drops ...etc).

dave
  • 4,812
  • 4
  • 25
  • 38
A2maridz
  • 341
  • 1
  • 4
  • 11
  • 1
    This is going to depend on the platform. You'll need to make some sort of device driver ioctl() call assuming the driver supports that. – Tall Jeff Feb 28 '14 at 23:11
  • Yes i'm traying to find a way that the device don't drop the bad frames (deliver them and notify me that they are bad) – A2maridz Mar 06 '14 at 07:23
  • Modern ethernet interfaces will check the FCS and drop bad frames in the hardware, never sending the frame up to the software. – Ron Maupin Sep 24 '20 at 16:34

2 Answers2

19

You didn't specify which OS, but I can at least speak for Linux:

It may depend on your kernel, NIC and driver as well as ethtool versions.

We need to tell the driver/hardware to do two things it doesn't normally do:

  1. Pass the FCS field up the networking stack. (Generally this gets truncated before being passed up)
  2. Not drop packets with bad FCS fields, instead pass them up as-is

There are two ethtool options to achieve each of these:

ethtool -K eth0 rx-fcs on  #1 above: give us the FCS field
ethtool -K eth0 rx-all on  #2 above: even receive bad packets

With these, I am able to use wireshark or tcpdump to view FCS fields, even if they are not correct. (in my case I have some network device that replaces the checksum on-the-fly with an accurate timestamp - which causes the packets to appear 'bad', and I use the above to recover)

Not all cards will implement this! They may have the above ethtool options 'fixed' off or not respond to them.

At 1G speeds I've seen e1000 cards work well. At 10G I am yet to find a NIC that does this at all, and have to rely on more complex data acquisition cards.

Again, I don't know what the minimum kernel/ethtool version requirements are, but I do recall having to upgrade a CentOS server in order to get it to work.

I also know that r8169 and e1000 drivers/cards can do it, but can't speak for any other combination at all.

Also note you won't be able to capture outgoing FCS values on the machine you're sending them because they're added quite late in the process (perhaps offloaded to the card itself) so will not be visible to pcap.

On a Linux 3.10.11 kernel, with ethtool 3.10:

$ ethtool -k eth0
Features for eth0:
rx-checksumming: on
tx-checksumming: on
    tx-checksum-ipv4: off [fixed]
    tx-checksum-ip-generic: on
    tx-checksum-ipv6: off [fixed]
    tx-checksum-fcoe-crc: off [fixed]
    tx-checksum-sctp: off [fixed]
scatter-gather: on
    tx-scatter-gather: on
    tx-scatter-gather-fraglist: off [fixed]
tcp-segmentation-offload: on
    tx-tcp-segmentation: on
    tx-tcp-ecn-segmentation: off [fixed]
    tx-tcp6-segmentation: on
udp-fragmentation-offload: off [fixed]
generic-segmentation-offload: on
generic-receive-offload: on
large-receive-offload: off [fixed]
rx-vlan-offload: on
tx-vlan-offload: on
ntuple-filters: off [fixed]
receive-hashing: on
highdma: on [fixed]
rx-vlan-filter: on [fixed]
vlan-challenged: off [fixed]
tx-lockless: off [fixed]
netns-local: off [fixed]
tx-gso-robust: off [fixed]
tx-fcoe-segmentation: off [fixed]
tx-gre-segmentation: off [fixed]
tx-udp_tnl-segmentation: off [fixed]
fcoe-mtu: off [fixed]
tx-nocache-copy: on
loopback: off [fixed]
rx-fcs: off
rx-all: off
tx-vlan-stag-hw-insert: off [fixed]
rx-vlan-stag-hw-parse: off [fixed]
rx-vlan-stag-filter: off [fixed]

And then:

$ sudo ethtool -K eth0 rx-fcs on rx-all on

Gives me:

$ ethtool -k eth0
Features for eth0:
rx-checksumming: on
tx-checksumming: on
    tx-checksum-ipv4: off [fixed]
    tx-checksum-ip-generic: on
    tx-checksum-ipv6: off [fixed]
    tx-checksum-fcoe-crc: off [fixed]
    tx-checksum-sctp: off [fixed]
scatter-gather: on
    tx-scatter-gather: on
    tx-scatter-gather-fraglist: off [fixed]
tcp-segmentation-offload: on
    tx-tcp-segmentation: on
    tx-tcp-ecn-segmentation: off [fixed]
    tx-tcp6-segmentation: on
udp-fragmentation-offload: off [fixed]
generic-segmentation-offload: on
generic-receive-offload: on
large-receive-offload: off [fixed]
rx-vlan-offload: on
tx-vlan-offload: on
ntuple-filters: off [fixed]
receive-hashing: on
highdma: on [fixed]
rx-vlan-filter: on [fixed]
vlan-challenged: off [fixed]
tx-lockless: off [fixed]
netns-local: off [fixed]
tx-gso-robust: off [fixed]
tx-fcoe-segmentation: off [fixed]
tx-gre-segmentation: off [fixed]
tx-udp_tnl-segmentation: off [fixed]
fcoe-mtu: off [fixed]
tx-nocache-copy: on
loopback: off [fixed]
rx-fcs: on
rx-all: on
tx-vlan-stag-hw-insert: off [fixed]
rx-vlan-stag-hw-parse: off [fixed]
rx-vlan-stag-filter: off [fixed]
maxschlepzig
  • 35,645
  • 14
  • 145
  • 182
David Mirabito
  • 455
  • 5
  • 13
  • I'm working on ubuntu 12.04 I tried to use the ethtool tool but i don't have the rx-fcs and rx-all arguments. this is the arguments that i have when i type the man ethtool ethtool -K|--offload devname [rx on|off] [tx on|off] [sg on|off] [tso on|off] [ufo on|off] [gso on|off] [gro on|off] [lro on|off] [rxvlan on|off] [txvlan on|off] [rxhash on|off] And -K --offload Changes the offload parameters of the specified network device. – A2maridz Jun 13 '14 at 07:23
  • 1
    @A2maridz, OK, well I don't know a comprehensive list of what kernel/NIC/ethtool combinations work. I've updated the answer with the one known-good combination I have access to. What version of ethtool does ubuntu ship? And I believe they put the option under -K because you're effectively configuring whether the card performs FCS checks and truncations (i.e. offloading it) or not. – David Mirabito Jun 15 '14 at 22:46
  • For everyone that didn't squint hard enough, that's `ethtool -k ` **small** `k` to print out the card information, and `ethtool -K rx-all on` **big** `K` to change the setting(s). – yano Dec 16 '22 at 14:55
-2

you can open a raw socket using socket() call. for example the following call opens a raw TCP socket:

int fd = socket (PF_INET, SOCK_RAW, IPPROTO_TCP);

you can change the protocol to whichever you want and you can be sure that you receive every packet.

The above code will only get you a capture of good packets as the damaged packets don't even make it to OS and are dropped either at switch first or at the line card driver connected to your PC. More discussion on the same topic can be found here at Wireshark wiki page

Ankit Kumar
  • 1,433
  • 1
  • 16
  • 24
  • 1
    I think you will find that this does not work. Bad frames are dropped by the MAC during receive processing. The device driver needs to be configured to tell the device to accept bad frames. – Tall Jeff Feb 28 '14 at 23:09
  • yeah, agree with you. I have edited the answer. Standard Network card drivers automatically drops the damaged packets at the driver level and don't forward it to OS which also makes sense. but is there any way to configure the standard line card drivers to forward even the damaged packets to OS? – Ankit Kumar Mar 01 '14 at 18:19
  • No, there is no standard way to do that.You would need to read through the source code for the drivers and see if the driver happens to have an option to configure that, possibly read the data sheet for the chip and implement it yourself if the chip supports it. – nos Mar 01 '14 at 18:33
  • Yes i'm traying to find a way that the device don't drop the bad frames (deliver them and notify me that they are bad) I think that there is a way to do it, cause there is some traffic generators that send and receive traffic and gives statistic (even droped frame) – A2maridz Mar 06 '14 at 07:24