Ethereal-users: Re: [Ethereal-users] confusion about TCP checksum calculation

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Hamish Moffatt <hamish@xxxxxxxxxxxx>
Date: Wed, 2 Jan 2002 22:24:34 +1100
On Wed, Jan 02, 2002 at 02:42:47AM -0800, Guy Harris wrote:
> On Wed, Jan 02, 2002 at 11:42:58AM +1100, Hamish Moffatt wrote:
> > Oddly enough the IP header has the total length field set to 1500
> > (as captured), which is wrong.
> 
> It's wrong?  Are you certain of that?  Or is the Ethernet frame, as per
> the suggestion in my previous mail, a 1500-byte-plus-14-byte-Ethernet-header
> frame, so that the total length is correct, but truncated to 96 bytes
> due to a small snapshot length in tcpdump or Ethereal?

You're right; I captured the packet with tcpdump with the default
options. I'm still not sure how Ethereal knows that the checksum
was correct on the original packet then - or doesn't it attempt
to check it if some of the packet is missing?


thanks,
Hamish
-- 
Hamish Moffatt VK3SB <hamish@xxxxxxxxxx> <hamish@xxxxxxxxxxxx>