Sounds like a bug in either libpcap or Ethereal. When capturing on
Ethereal, does the TCP checksum field contain the correct value? In
other words, is the checksum field populated with the correct value, and
the calculation is wrong... Or, is the checksum field in the capture
wrong, and the calculation is right.
Perhaps you should setup an instance of Ethereal on the Solaris machine
orginating the traffic, and then on some other machine on the network.
Set them both to capture than originate some traffic. This would allow
someone to compare the traces to see where the fault is.
-Devin
On Fri, 2003-02-28 at 11:00, Biot Olivier wrote:
> The problem sometimes lies in the capturing of data that still has to get
> onto the wire. Although the checksum is correctly calculated and the packet
> correctly sent over the wire, the capture displays checksum errors. This
> however does not happen with UDP traffic.
>
> Perhaps the state management of TCP sessions and its interaction with the
> packet filter causes this type of artefacts...
>
> > -----Original Message-----
> > From: Jason House [mailto:jhouse@xxxxxxxxx]
> >
> > Biot Olivier wrote:
> > >
> > > Agreed but only partially. If the trace is taken on some SUN Solaris
> > > machines from which the TCP traffic is originating, then
> > all sent TCP
> > > packets will probably have a bad TCP checksum.
> >
> >
> > This sounds really odd to me... If a SUN Solaris machine transmits
> > packets with bad checksums, the packets should never end up with good
> > checksums, and whoever it tries to talk to should chuck the TCP
> > packets... What am I missing here?
> >
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
--
Devin Heitmueller
Senior Software Engineer
Netilla Networks Inc
