Beavis is back and I wanna show him a raw IP dump

["Stephen J. Turnbull" <turnbull@example.com>]

OK, "Beavis" (my network manager) is at it again.  AFAICT my gateway
router is hosing packets every so often.  Of course Beavis says the
router's setup is correct and he can't see any problems.

Well, if I configure two hosts so that they can only see each other
through the router, I can get maybe 20 (to start) to 10 KB/sec
(bandwidth goes down over time) FTP transfers (10Mbps ethernot[1]).

There sure _is_ a problem.  UDP-based protocols hardly work at all (no
surprise, that).  Even X: I'm currently doing ssh tunnels so I can get
reliable X connections :(

What I'm seeing is lots of errors in the RX line of ifconfig's report
(normally >1%, I can push that to almost 20% by doing a high-bandwidth
transfer as above).  Most (70--90%) of these are "frame" problems.

(1) What exactly is ifconfig reporting in the "frame" field of the RX
    line?

(2) Is there some way I can directly tap this, at both ends of the
    connection?  Beavis wants evidence; what I would like to do is send
    him matched transcripts of an FTP transfer of mozilla-M17.tar.bz2
    if I can get it.

tcpdump doesn't seem to DWIW; the broken packets are already filtered
out.

Maybe something through IP chains?

I know there are tools that can get at those very low-level things
(karpski, ethereal), but I haven't figured out how to get them to tell
me what, if anything, is broken in what they're seeing.

TIA

Footnotes: 
[1]  sic.  Nice typo, think I'll keep it.

-- 
University of Tsukuba                Tennodai 1-1-1 Tsukuba 305-8573 JAPAN
Institute of Policy and Planning Sciences       Tel/fax: +81 (298) 53-5091
_________________  _________________  _________________  _________________
What are those straight lines for?  "XEmacs rules."