Guy Harris wrote:
>On Wed, Feb 26, 2003 at 09:19:30AM +1100, Brett Wheeler wrote:
>> Running Ethereal 0.9.3 on Win 2k with WinPcap 2.3 over a Netware 6.0
>> Network.
>>
>> I have been noticing lately there have been quite a few (appx 30%) TCP
>> packets showing an incorrect checksum.
>
>Are they all packets being sent by the machine running Ethereal?
>
>Does your network interface support TCP checksum offloading? (Windows
>2000 can support checksum offloading on network interfaces.)
>
>If both are the case, this is probably normal - for outgoing packets
>sent on an interface that does checksum offloading, the TCP code in the
>OS will *not* compute a checksum for the packet, and will *not* set the
>checksum in the packet, before it's sent to the network interface, which
>means it will also not set it before it's handed to the WinPcap driver.
Maybe it would be good with a separate item in the Ethereal FAQ about "incorrect checksum"?
Worth to know is also that you may need to turn of "Check the validity of the TCP checksum when possible"
in Edit/Preferences.../Protocols/TCP in order to get TCP desegmentation to work if you want to
have TCP packets desegmented and have checked the "Allow subdissector to desegment TCP streams" .
Actually I think that it would be better to have one preference whether to calculate and indicate "incorrect checksum"
and a separate preference setting for whether packets with incorrect checksum should be considered during desegmentation
- but currently there is only one preference setting for this.
I often get captures from collegues where the TCP checksum is incorrect due to "checksum offloading" dependant
on what OS they are using etc.
I normally have the "Check the validity of the TCP checksum when possible" setting unchecked.