A corrupted packet arrives on the network card (incorrect CRC32).

What happens to him next? Is it dropped on the spot or is it already filtered at the driver or OS level? And is there a way to view it on a computer?

  • Simply, there is a device that, when connected to a switch (some kind of professional equipment, not scrap metal), is even short, less than a meter, it receives dead packets with a patch cord. I made a meter on the basis of this device, he showed up to 1-2% of the beating at the reception. With the majority of other switches, even the same manufacturer, even on long lines of problems, in general, no. To determine somehow reliably (not by this indicator) that this is a switch commutator, and not a device conflict with it. Or vice versa, that only this device can sometimes fail to disassemble its transmissions. - Alexey Sonkin
  • Do you have speed and duplex settings on your device and switch? VLAN must be untagged, if there is any. - Dex
  • I do not know, I can not get into those switches (but hardly anyone reconfigured them from the default port settings). But in general, shouldn’t they themselves decide that the device wants 10 Mbps half duplex? =) The d-link des-1210 is quite self-determined by the automaton. - Alexey Sonkin
  • > Autonegotiation between devices failed. It’s not a problem. However, as I imagine it, if one side is not configured for the definition of speed, then the other is not sensible either. - Dex
  • Clear. Yeah, I tried. The device tuned into full duplex (it can do 100 Mbit, but may not have time to process it, the speed is lowered specially), the switch is only in half duplex. Perhaps it would be more appropriate to do so. Check: an interesting link on the topic: brocade.com/downloads/documents/html_product_manuals/… - Alexey Sonkin

2 answers 2

When decapsulating and reconciling CRC, the frame is dropped at the Media Access Control stage, since it is not possible to define the illegal frame at the physical level without decapsulating it. These are already engaged in the core of the OS. Look, it seems to me that it is possible, because for example the same tcpdump uses the libpcap library, which in turn works before the kernel decapsulates. I’m sure that ip is accurate before decapsulation, but I’m not sure about ethernet.

  • Piglet, as I recall, in Ethernet, and this is the data link layer of OSI, it is CRC-32 that is used. So, the wrong packets there are simply discarded. - areshin
  • That's right, you just probably forgot that MAC is a data link layer. - pyatak
  • @pyatak, CRC reconciliation should ideally be "On Go". It seems to me that there is no de-encapsulation as such, there is a stream of bytes with delimiters.> (such as zero) when it is correct. Frame an ending delimiter. by Wendell ODOM, Ccie #1624, Cisco Official Cert Guide, Book 1, Chapter 3 : Fundamentals of LANs, Page 74 - Dex
  • Not all operating systems return FCS, the same WireShark can simply show zero. Moreover, in addition to dropping the frame, it is necessary to notify the transmitter. - Dex
  • Take me to Switzerland. I would have discussed with you. ) - pyatak

They are discarded, usually at the driver level. This is the channel layer of the OSI model, and nothing more is required of it. Error correction is carried out at higher levels.

  • But the driver is the physical level. - pyatak
  • The driver makes the transition from physical to channel. - areshin