Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] TCP checksum offloading and non-zero checksums

From: Vic Chester <vcsubscriptions@xxxxxxxxx>
Date: Fri, 23 Nov 2018 19:06:06 -0500
That could be the case. It would be great if someone could confirm that is how it works.

As for the VM, it was communicating with hosts across the internet. Not VM to VM.

Thanks

On Fri, Nov 23, 2018, 7:03 PM Guy Harris <guy@xxxxxxxxxxxx wrote:
On Nov 23, 2018, at 3:57 PM, Vic Chester <vcsubscriptions@xxxxxxxxx> wrote:

> I was under the impression that if TCP checksum offloading occurs, the actual TCP checksum would be zero. Can anyone confirm?

I would not assume that; the networking stack might just not bother initializing the checksum field to zero before handing a packet to a NIC doing checksumming.

> The reason I ask is because I have a capture from a Centos 7 VM where several packets (73) are reported as having incorrect TCP checksums. The actual checksums are not zero however, and some of them when have replies to them. If the checksum was really incorrect the ip stack of the receiver should have discarded the packet.

And if this is a "virtual NIC" that just moves packets from one VM to another, it might not even bother generating a checksum - or checking it on the other side.  If *memory* isn't reliable, you have bigger problems than just "TCP connections between VMs might get corrupted data"....
___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    https://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe