[Guy Harris <guy@xxxxxxxxxx>]

> You're right; I captured the packet with tcpdump with the default
> options.

Ah, yes, those lovely default tiny-little-snapshot-length default
actions.  Fine if you're using tcpdump to look at TCP's behavior (other
than checking its checksum), not so fine if you're using it to, for
example, look at NFS's behavior.

> I'm still not sure how Ethereal knows that the checksum
> was correct on the original packet then - or doesn't it attempt
> to check it if some of the packet is missing?

It doesn't attempt to check the checksum if there's insufficient data to
compute the checksum.  (tcpdump does the same thing.)