Ethereal-users: Re: [Ethereal-users] Skinny Capture!

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Martin Regner" <martin.regner@xxxxxxxxx>
Date: Sun, 4 May 2003 10:39:45 +0100
Joerg Meyer wrote:
<How is it that this frame and its resent (Frame 22) are the only ones that
<have an incorrect TCP checksum?

If the capturing is done on 192.1.2.200 and there is checksum calculation offload then that could explain why the TCP checksum
is incorrect on some (or in some cases all) packets sent from 192.1.2.200.
http://www.ethereal.com/faq.html#q5.8

I guess that the capturing is done on 192.1.2.200 since there is no Ethernet padding added on the packets sent from 
192.1.2.200 that are shorter than 60 bytes (plus the 4 byte Ethernet CRC that will in most cases not be visible in the capture anayway), but packets sent from the other ip-address are padded to 60 bytes.

There will of course be padding added before sending the packets on Ethernet, but the padding is not visible in the
capture.

TCP checksum calculation offload doesn't mean that all packets sent from 192.1.2.200 will have incorrect checksum. 
I have seen before that the TCP checksum seems to be correct on the small packets (maybe max 60 bytes?) but in most cases incorrect on longer packets when using TCP checksum offloading.