https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7759
--- Comment #11 from Chris Maynard <christopher.maynard@xxxxxxxxx> 2012-09-28 18:20:32 PDT ---
(In reply to comment #0)
> Now wireshark marks all those packets bad, because of the "bad" checksum.
I'm wondering, what exactly is the problem though? I mean any way you slice
it, the checksum is bad when Wireshark is handed the packet for analysis.
Is it perhaps that you don't like to see those packets colored the same way as
other bad checksums? For that, you could change the default "Checksum Errors"
coloring rule to be, "... || (ip.checksum_bad==1 && !(ip.checksum==0)) || ...",
and we could even make that change permanent in the default rules.
Or is it perhaps that filtering for "ip.checksum_bad==1" also includes those
packets with a checksum of 0? For that, you need only change the filter to be,
"(ip.checksum_bad==1) && !(ip.checksum==0)", which you could save as your own,
"Bad non-0 IP checksums" display filter rule for convenience.
Or is it that they show up as "Bad checksum" in the Expert Infos, grouped with
all other bad checksums? For that, we could categorize them differently,
moving them to a different Expert Infos for "Zero checksum, possibly due to IP
checksum offload", and maybe even move it from an error to a warning.
All of the above? More than this? Would those proposed changes above suffice?
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.