Ethereal-dev: RE: [Ethereal-dev] TCP Framentation bug?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Biot Olivier <Olivier.Biot@xxxxxxxxxxx>
Date: Fri, 28 Feb 2003 17:09:46 +0100
> -----Original Message-----
> From: Devin Heitmueller [mailto:dheitmueller@xxxxxxxxxxx]
> 
> Is this some product of doing the checksum comptuation in 
> hardware, and
> the libpcap intercepts the packet before checksumming is performed?

Sometimes the checksum is just anything, at other times it is the CRC of the
TCP pseudo-header (I computed some checksums by hand using an ... Excel
sheet :). So it looks like we're capturing the TCP data while the device
driver is recomputing the TCP checksum. Weird, isn't it?

> Is the checksum set to a constant, such as zero?  Perhaps this is
> something we can key off of by default for those platforms?

Nope, it is definitely not predictable. However one of the TCP preferences
reads "check the validity of the TCP checksum when possible". I suppose we
bypass TCP checksum verification altogether when this toggle is off (or am I
wrong)...

Regards,

Olivier