Can Wireshark capture an entire Ethernet frame including preamble, CRC and Interframe spacing?
I am examining an Ethernet frame in Wireshark. According to the "Ethernet frame" Wikipedia article and accompanying diagrams, "A frame starts with a 7-octet preamble and 1-octet start frame delimiter (SFD)."
The article also highlights that "[the] preamble and start frame delimiter are not displayed by packet sniffing software because these bits are stripped away at OSI Layer 1 by the network interface controller before being passed on to the OSI layer 2 which is where packet sniffers collect their data."
My question is: is there a way to capture and display the entire Ethernet frame using Wireshark? If not, is it possible to achieve this without the use of additional hardware?
//synack
My question is: is there a way to capture and display the entire Ethernet frame using Wireshark?
Only if you have a network adapter that captures the entire frame and supplies it to the host, a driver for that adapter that sets up the adapter to do that, and a capture mechanism in the OS (or otherwise connected to libpcap/WinPcap) that allows that to be supplied.
I know of NO Ethernet adapters that supply the preamble and SFD.
At least some adapters might, however, supply the CRC/FCS. (The adapter on a Mac I used many years ago did; I don't think the adapters in current Macs do.) Wireshark attempts to guess whether an Ethernet packet has an FCS and, if it thinks it does, handles it as such. (I added the code to do that to Wireshark when I was using the Mac in question.)
If not, is it possible to achieve this without the use of additional hardware?
No, as the previous part of the answer suggests.
Hilscher Gesellschaft für Systemautomation mbH has a line of netAnalyzer devices that can be put into "transparent mode"; in that mode, the preamble, SFD, and FCS are all present, and Wireshark can read pcap files produced by those devices.
I think Endace's DAG cards can supply the FCS, but they can't supply the preamble or SFD, as far as I know.