Wireshark · Ethereal-users: Re: [Ethereal-users] reading an "incorrect Checksum" with a Snoop Capture

[Guy Harris <gharris@xxxxxxxxx>]

julien lecomte wrote:

> At the end of a backup, I have an "Incorrect checksum" in a [FIN, 
> ACK] packet sent by the server where snoop is capturing the packets.

"snoop" suggests that the capture was done on a Sun running Solaris, and 
Suns and Solaris support checksum offloading on at least some adapters 
(as do many other machines and many other driver/OS networking stack 
combinations):

	http://www.ethereal.com/faq#q5.14

> Can you tell me how Ethereal is deducing this?

By computing the checksum of the packet and comparing it with the 
checksum in the packet *as captured* (the FAQ item above explains that, 
for packets sent by the machine on which the capture program is running, 
the packet as captured is not the same as the packet as transmitted, if 
checksum offloading is being done).