7
votes

I generate a traffic between two PCs running Linux (by sending Ethernet frames), the goal of this is to capture some errors frames. The problem is when the Phy layer detect an error on a frame (if the CRC or FCS is not valid) the frame is dropped and I can't receive it in my program.

Are the any way to receive the wrong frame (disable the drops in the Phy layer and receiving a indicator that indicate that this frame is wrong for example) and how can i consult the statistic of the NIC card (number of drops ...etc).

2
This is going to depend on the platform. You'll need to make some sort of device driver ioctl() call assuming the driver supports that.Tall Jeff
Yes i'm traying to find a way that the device don't drop the bad frames (deliver them and notify me that they are bad)A2maridz
Modern ethernet interfaces will check the FCS and drop bad frames in the hardware, never sending the frame up to the software.Ron Maupin

2 Answers

16
votes

You didn't specify which OS, but I can at least speak for Linux:

It may depend on your kernel, NIC and driver as well as ethtool versions.

We need to tell the driver/hardware to do two things it doesn't normally do:

  1. Pass the FCS field up the networking stack. (Generally this gets truncated before being passed up)
  2. Not drop packets with bad FCS fields, instead pass them up as-is

There are two ethtool options to achieve each of these:

ethtool -K eth0 rx-fcs on  #1 above: give us the FCS field
ethtool -K eth0 rx-all on  #2 above: even receive bad packets 

With these, I am able to use wireshark or tcpdump to view FCS fields, even if they are not correct. (in my case I have some network device that replaces the checksum on-the-fly with an accurate timestamp - which causes the packets to appear 'bad', and I use the above to recover)

Not all cards will implement this! They may have the above ethtool options 'fixed' off or not respond to them.

At 1G speeds I've seen e1000 cards work well. At 10G I am yet to find a NIC that does this at all, and have to rely on more complex data acquisition cards.

Again, I don't know what the minimum kernel/ethtool version requirements are, but I do recall having to upgrade a CentOS server in order to get it to work.

I also know that r8169 and e1000 drivers/cards can do it, but can't speak for any other combination at all.

Also note you won't be able to capture outgoing FCS values on the machine you're sending them because they're added quite late in the process (perhaps offloaded to the card itself) so will not be visible to pcap.

On a Linux 3.10.11 kernel, with ethtool 3.10:

$ ethtool -k eth0
Features for eth0:
rx-checksumming: on
tx-checksumming: on
    tx-checksum-ipv4: off [fixed]
    tx-checksum-ip-generic: on
    tx-checksum-ipv6: off [fixed]
    tx-checksum-fcoe-crc: off [fixed]
    tx-checksum-sctp: off [fixed]
scatter-gather: on
    tx-scatter-gather: on
    tx-scatter-gather-fraglist: off [fixed]
tcp-segmentation-offload: on
    tx-tcp-segmentation: on
    tx-tcp-ecn-segmentation: off [fixed]
    tx-tcp6-segmentation: on
udp-fragmentation-offload: off [fixed]
generic-segmentation-offload: on
generic-receive-offload: on
large-receive-offload: off [fixed]
rx-vlan-offload: on
tx-vlan-offload: on
ntuple-filters: off [fixed]
receive-hashing: on
highdma: on [fixed]
rx-vlan-filter: on [fixed]
vlan-challenged: off [fixed]
tx-lockless: off [fixed]
netns-local: off [fixed]
tx-gso-robust: off [fixed]
tx-fcoe-segmentation: off [fixed]
tx-gre-segmentation: off [fixed]
tx-udp_tnl-segmentation: off [fixed]
fcoe-mtu: off [fixed]
tx-nocache-copy: on
loopback: off [fixed]
rx-fcs: off
rx-all: off
tx-vlan-stag-hw-insert: off [fixed]
rx-vlan-stag-hw-parse: off [fixed]
rx-vlan-stag-filter: off [fixed]

And then:

$ sudo ethtool -K eth0 rx-fcs on rx-all on

Gives me:

$ ethtool -k eth0
Features for eth0:
rx-checksumming: on
tx-checksumming: on
    tx-checksum-ipv4: off [fixed]
    tx-checksum-ip-generic: on
    tx-checksum-ipv6: off [fixed]
    tx-checksum-fcoe-crc: off [fixed]
    tx-checksum-sctp: off [fixed]
scatter-gather: on
    tx-scatter-gather: on
    tx-scatter-gather-fraglist: off [fixed]
tcp-segmentation-offload: on
    tx-tcp-segmentation: on
    tx-tcp-ecn-segmentation: off [fixed]
    tx-tcp6-segmentation: on
udp-fragmentation-offload: off [fixed]
generic-segmentation-offload: on
generic-receive-offload: on
large-receive-offload: off [fixed]
rx-vlan-offload: on
tx-vlan-offload: on
ntuple-filters: off [fixed]
receive-hashing: on
highdma: on [fixed]
rx-vlan-filter: on [fixed]
vlan-challenged: off [fixed]
tx-lockless: off [fixed]
netns-local: off [fixed]
tx-gso-robust: off [fixed]
tx-fcoe-segmentation: off [fixed]
tx-gre-segmentation: off [fixed]
tx-udp_tnl-segmentation: off [fixed]
fcoe-mtu: off [fixed]
tx-nocache-copy: on
loopback: off [fixed]
rx-fcs: on
rx-all: on
tx-vlan-stag-hw-insert: off [fixed]
rx-vlan-stag-hw-parse: off [fixed]
rx-vlan-stag-filter: off [fixed]
-2
votes

you can open a raw socket using socket() call. for example the following call opens a raw TCP socket:

int fd = socket (PF_INET, SOCK_RAW, IPPROTO_TCP);

you can change the protocol to whichever you want and you can be sure that you receive every packet.

The above code will only get you a capture of good packets as the damaged packets don't even make it to OS and are dropped either at switch first or at the line card driver connected to your PC. More discussion on the same topic can be found here at Wireshark wiki page