Wireshark · Ethereal-users: Re: [Ethereal-users] Possibly i found a bug

[Guy Harris <gharris@xxxxxxxxx>]

U. Siegel wrote:

> possibly i found a bug in my ethereal 0.10.13.
> During investigation of a LDAP problem i found one packet truncated due 
> to capture size limitation.
> The cheksum in packet was given w/ "0x602a [incorrect, should be 0x8f9e]".
> Because i do not expect a problem related to the checksum given within 
> the packet i would expect a problem in how ethereal comes to checksum in 
> truncated packets.

It might be that this is a packet transmitted by your machine, with 
checksum offloading.

Or it might be that there's a bug in the checksum code, so that it 
doesn't just give up on computing the checksum if all the data isn't there.

Is that the IPv4 header checksum, the UDP checksum, the TCP checksum, or 
some other checksum?  Do you have a capture file you can send us that 
contains a packet with this problem?  Does this happen with libpcap 0.99.0?