Here's a dump of one of the packets that ethereal claims bad
TCP checksums on.
Frame 10 (60 on wire, 60 captured)
Arrival Time: Jun 6, 2001 13:09:36.7119
Time delta from previous packet: 0.000156 seconds
Time relative to first packet: 5.386718 seconds
Frame Number: 10
Packet Length: 60 bytes
Capture Length: 60 bytes
Ethernet II
Destination: 00:00:0c:07:ac:b8 (00:00:0c:07:ac:b8)
Source: 08:00:69:0b:8f:48 (08:00:69:0b:8f:48)
Type: IP (0x0800)
Trailer: 00000008BF09
Internet Protocol
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x10 (DSCP 0x04: Unknown DSCP; ECN: 0x00)
0001 00.. = Differentiated Services Codepoint: Unknown (0x04)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 40
Identification: 0x1b9c
Flags: 0x04
.1.. = Don't fragment: Set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 60
Protocol: TCP (0x06)
Header checksum: 0xa8f8 (correct)
Source: tardis.americas.sgi.com (128.162.184.103)
Destination: 24-240-40-50.hsacorp.net (24.240.40.50)
Transmission Control Protocol, Src Port: 21443 (21443), Dst Port: 22 (22), Seq: 1680596439, Ack: 120121820
Source port: 21443 (21443)
Destination port: 22 (22)
Sequence number: 1680596439
Acknowledgement number: 120121820
Header length: 20 bytes
Flags: 0x0010 (ACK)
0... .... = Congestion Window Reduced (CWR): Not set
.0.. .... = ECN-Echo: Not set
..0. .... = Urgent: Not set
...1 .... = Acknowledgment: Set
.... 0... = Push: Not set
.... .0.. = Reset: Not set
.... ..0. = Syn: Not set
.... ...0 = Fin: Not set
Window size: 49152
Checksum: 0xb932 (incorrect, should be 0xeec6)
0 0000 0c07 acb8 0800 690b 8f48 0800 4510 ........i..H..E.
10 0028 1b9c 4000 3c06 a8f8 80a2 b867 18f0 .(..@.<......g..
20 2832 53c3 0016 642b ddd7 0728 e9dc 5010 (2S...d+...(..P.
30 c000 b932 0000 0000 0008 bf09 ...2........
> Hi everyone,
>
> I'm building Ethereal 0.8.18 sources on MIPS/IRIX. Eventhough
> the program builds fine and works great, the TCP checksum
> verification seems broken. The content of the packet are
> OK, I can pick out the data just fine.
> Approximately 75% of TCP packets complain of an invalid
> checksum.
> MIPS/IRIX is a big endian system that doesn't permit
> unaligned access.
>
> Thanks in advance,
>
> Jens Petersohn