Wireshark · Ethereal-dev: Re: [Ethereal-dev] TCP checksums

[Guy Harris <gharris@xxxxxxxxx>]

On Sun, Oct 21, 2001 at 06:11:42PM +0100, Mark Burton wrote:
> I have discovered that if you capture packets under linux 2.4.4 from
> an 3c905c ethernet card, the TCP checksum is sometimes wrong. I don't
> understand what's going on in the kernel but I assume it's something
> to do with the fact that the card supports hardware checksumming.

Perhaps, but that'd be really annoying (although, alas, not unheard of
on Linux; we've seen other cases where various networking stack features
cause the data that was sent to or received from the wire isn't the same
as the data passed up to PF_PACKET sockets).

Perhaps the networking card, if hardware TCP checksumming is enabled,
doesn't just copy the raw packet data to the host's memory, but puts
some other stuff in the checksum field of the TCP header.

> Anyway, is it worth adding a preference to the TCP dissector to allow
> desegmentation of packets even though the checksum is bad?

It might be.