Runts aand how to find the source of it ?

vancampdax · ‎12-24-2008

According to the information found on the CISCO website a runt is defined as a packet with less than 64bytes AND a bad CRC.

I'm using wireshark to capture an interface where I have a lot of input errors the same amount as runts.

But when I analyze the trace file I can't find any packet with a bad CRC. I have no problem finding packets with less than 64 bytes (arp requests for example ).

How am I able to determine the source of my runts then ?

dabels · ‎12-24-2008

what is the connection that is getting the runts? the runts will be on the link that is complaining of the runts.. a runt should not be forwarded by any device so it should not get propagated thru a switch or router. so verify that there is not a duplex mismatch on the two devices.

vancampdax · ‎12-25-2008

The error on a 1000Mb fiber uplink between 2 switches.

The other switch isn't reporting any errors.

There is no duplex mismatch

thomasdzubin · ‎12-24-2008

Note that some network cards silently throw away packets that are considered "errors" so you may not even see CRC or runt packets within Wireshark.

And actually, from the Wireshark FAQ:

http://www.wireshark.org/faq.html#q7.9

"Q 7.9: How can I capture packets with CRC errors?

A: Wireshark can capture only the packets that the packet capture library - libpcap on UNIX-flavored OSes, and the WinPcap port to Windows of libpcap on Windows - can capture, and libpcap/WinPcap can capture only the packets that the OS's raw packet capture mechanism (or the WinPcap driver, and the underlying OS networking code and network interface drivers, on Windows) will allow it to capture.

Unless the OS always supplies packets with errors such as invalid CRCs to the raw packet capture mechanism, or can be configured to do so, invalid CRCs to the raw packet capture mechanism, Wireshark - and other programs that capture raw packets, such as tcpdump - cannot capture those packets. You will have to determine whether your OS needs to be so configured and, if so, can be so configured, configure it if necessary and possible, and make whatever changes to libpcap and the packet capture program you're using are necessary, if any, to support capturing those packets.

Most OSes probably do not support capturing packets with invalid CRCs on Ethernet, and probably do not support it on most other link-layer types. Some drivers on some OSes do support it, such as some Ethernet drivers on FreeBSD; in those OSes, you might always get those packets, or you might only get them if you capture in promiscuous mode (you'd have to determine which is the case).

Note that libpcap does not currently supply to programs that use it an indication of whether the packet's CRC was invalid (because the drivers themselves do not supply that information to the raw packet capture mechanism); therefore, Wireshark will not indicate which packets had CRC errors unless the FCS was captured (see the next question) and you're using Wireshark 0.9.15 and later, in which case Wireshark will check the CRC and indicate whether it's correct or not.

vancampdax · ‎12-25-2008

I also read this article, but, I'm capturing data from a switch port and I don't find any ifo that CISCO also is dropping these packets witch CRC errors.