How do you send an Ethernet frame with a corrupt FCS?

Question

I\'m not sure if this is even possible since this might be handled in hardware, but I need to send some Ethernet frames with errors in them. I\'d like to be able to create r

Answer 1

It can be handled in hardware, but isn't always -- and even if it is, you can turn that off; see the ethtool offload parameters.

With regard to getting full control over the frames you create -- look into PF_PACKET (for one approach) or the tap driver (for another).

Here's an article on using PF_PACKET to send hand-crafted frames from Python.

Answer 2

try using scapy for python, there are examples to generate jumbo frames, a runt frames too. http://www.dirk-loss.de/scapy-doc/usage.html

Answer 3

The program did not work as intended for me to generate FCS errors.

The network driver added the correct checksum at the end of the generated frame again. Of course it's quite possible that the solution is working for some cards, but I'm sure not with any from Intel. (It's also working without any ethtool changes for me.)

With at least an Intel e1000e network card you need a small change to the code above: Add the following line after "s = socket(AF_PACKET, SOCK_RAW)":

s.setsockopt(SOL_SOCKET,43,1)

This tell the NIC driver to use the "SO_NOFCS" option defined in socket.h and send the frame out without calculating and adding the FCS.

You may also be interested in the following C-programm, which did show me how to do it: http://markmail.org/thread/eoquixklsjgvvaom

But be aware that the program will not work on recent kernels without a small change. The SOL_SOCKET seems to have changed the numeric ID from 42 to 43 at some time in the past.

According to the original author the feature should be available for at least the following drivers: e100, e1000, and e1000e. A quick grep in the kernel sources of 3.16.0 is indicating that ixgbe igb and i40e should also work. If you are not using any of these cards this socket option will probably not be available.

Answer 4

First, you disable your ethernet card's checksumming:

sudo ethtool -K eth1 tx off

Then, you send the corrupt frames from python:

#!/usr/bin/env python

from socket import *

#
# Ethernet Frame:
# [
#   [ Destination address, 6 bytes ]
#   [ Source address, 6 bytes      ]
#   [ Ethertype, 2 bytes           ]
#   [ Payload, 40 to 1500 bytes    ]
#   [ 32 bit CRC chcksum, 4 bytes  ]
# ]
#

s = socket(AF_PACKET, SOCK_RAW)
s.bind(("eth1", 0))
src_addr = "\x01\x02\x03\x04\x05\x06"
dst_addr = "\x01\x02\x03\x04\x05\x06"
payload = ("["*30)+"PAYLOAD"+("]"*30)
checksum = "\x00\x00\x00\x00"
ethertype = "\x08\x01"
s.send(dst_addr+src_addr+ethertype+payload+checksum)

See A similar question