On Wed, Oct 30, 2002 at 06:40:06PM +0100, Martin Regner wrote:
> The other problem I had was related to that most outgoing packets over a
> certain size had incorrect checksum that made Ethreal not considering
> the packets with incorrect checksum when reassembling the tcp data.
>
> http://www.ethereal.com/lists/ethereal-users/200210/msg00059.html
In that message, you didn't mention that the problem was, as you appear
to be saying, only a problem with *outgoing* packets.
Given that, I suspect that the interface on which those packets are
being transmitted does TCP checksum offloading. If you are capturing
traffic on such an interface, the TCP checksums on outgoing packets will
probably show up as incorrect in the capture, as the outgoing packets
are *not* seen by the network interface on which you're capturing;
instead, the driver internally hands the packet to the capture mechanism
- but the TCP code won't have set the checksum field on the packet, as
it'll be relying on the network interface to do so, so the packet
handed to the capture mechanism, and thus to tcpdump or Ethereal or ...
will have a bad TCP checksum.
> After changing TCP settings Edit/Preferences.../Protocols/TCP it seems
> to work much better:
>
> -Check the validity of the TCP checksum (uncheck this option, so that
> desegmentation works even for packets with incorrect checksum)
In fact, the problem with TCP offloading is the reason *why* I added
that option (I ran across that problem with captures on a Sun gigabit
Ethernet interface here, and added the option to work around it).
> -Use relative sequence numbers (uncheck this option since there might
> be some problems with desegmention when using Ethereal 0.9.6 and 0.9.7).
Yes, I think there was a bug with desegmentation and relative sequence
numbers that Ronnie Sahlberg fixed after 0.9.7 was released.
