[Guy Harris <gharris@xxxxxxxxx>]

Radek Vokal wrote:

>  anyone experienced this: When I'm doing ping and capture UDP packets
> (I'm usind UDP encapsulation) with ethereal there's incorrect udp-
> checksum.

I.e., Ethereal reports that the UDP checksum is incorrect?

> I've tested this on different machines and it appears only on
> FC2 with different NIC.

(I assume "FC2" means Fedora Core 2.)

Does it appear on all NICs?  If so, do those NICs support offloading UDP 
checksums, as well as TCP checksums?  If they support offloading UDP 
checksums, this might be the same problem that's seen with NICs that 
support TCP checksum offloading:

	http://www.ethereal.com/faq#q5.14

> My questio is: How is ethereal computing the
> correct checksum?

It uses code based on BSD's Internet checksum code.

> Is the ethereal one computed using libpcap

No.

> or is it vice versa?

No.  It's independent of libpcap - which contains no checksum code, 
although recent versions of tcpdump do have checksum code and does the 
same sort of checking Ethereal does.

Tcpdump might correctly handle packets with source-routing IP options; I 
don't think Ethereal would currently do so.