Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-users: Re: [Ethereal-users] incorrect tcp checksums

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Mon, 14 Oct 2002 23:43:02 -0700
On Tue, Oct 15, 2002 at 08:33:20AM +0200, Mads Nielsen (DXD) wrote:
> However in most cases (when you not are fighting with low-level
> errors;-) I guess the average user would expect to see what are
> (supposed to be) sent on the wire. 

They might, but that doesn't mean they'll be able to get what they
expect.

> I would recommend that PCAP (or WinPCAP) detects whether checksums are
> calculated below it on outgoing packets (based on OS and/or driver).

That is a significant amount of work, as

	1) libpcap would have to, on several different platforms,
	   determine the type of networking interface *and* possibly
	   driver version (if not all versions of the driver for that
	   type of interface do offloading), so somebody would have to
	   figure out how to do that on all relevant platforms and
	   implement it;

	2) somebody would have to find out which interfaces have that
	   problem on which OSes, and potentially keep that list
	   up-to-date if you really want to avoid having average users
	   ever getting rudely surprised.

1) *might* be easier on platforms where there's an interface flag
indicating whether offloading is being done; I don't know which, if any,
platforms do that.

2) runs the risk of being a perpetual task as new interfaces are
released.

I would not expect to see your recommendation implemented any time soon.
(I certainly don't have any interest in ever working on it, and there's
nothing anybody can say to encourage me to do it; if somebody wants it
that badly, I recommend that they do it themselves.)