Ethernet PHY-Analyzer HowTo
I was testing my first implementation of an 100BaseT Ethernet PHY on a
FPGA as I ran against a wall: you can't see anything on your Ethereal
or tcpdump if the Frame is not 100% correct.
In fact the MAC-Chips on the most of NICs just filter out the frames with
errors (CRC, alignement, receiver not ready, overrun) and let only
the intact frames trough. The analyser software running on your
computer can't see these packets.
I surfed the net for some solution to visualize the complete traffic on
an ethernet cable including the errornous frames. The cheapest
device costs about 2500 Euros! It was definitely too expensive.
The solution was to transform my laptop into a PHY-Analyzer. The only
restriction is that you need to have an Intel Pro ethernet chip.
The FreeBSD Kernel driver has got the most complete implementation of the features of this chip.
After installing FreeBSD you just have to patch the driver file if_fxp.c located at /sys/dev/fxp/ with:
> // MY CODE!
> if (sp->rx_crc_errors ) device_printf(sc->dev,
> if (sp->rx_alignment_errors) device_printf(sc->dev,
> if (sp->rx_rnr_errors) device_printf(sc->dev,
> if (sp->rx_overrun_errors) device_printf(sc->dev,
< cbp->rcv_crc_xfer = 0; /* (don't) xfer CRC to host */
> cbp->rcv_crc_xfer = prm; /* CHANGED! xfer CRC to host */
this patch is working with version 188.8.131.52.2.1 but it should be easy to do the same with other versions ;-)
Then you have to recompile the kernel and reboot it. Now you can see the
FCS (checksum) of each frame in the promiscous mode with tcpdump or
Ethereal recognizes also a faulty FCS and gives you the right one. That's very useful for debugging your CRC32.
The patched driver throws an error message into the STDOUT when the
ethernet frame has a different kind of error (CRC,Alignement,RNR and
This was a big help at the beginning of the design.
Have a lot of fun!
P.S.: for feedback please mail me at this domain with the prefix "faical" (I don't like spam)