Wireshark-bugs: [Wireshark-bugs] [Bug 6556] TCP Checksum
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Mon, 14 Nov 2011 14:42:29 -0800 (PST)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=6556

--- Comment #2 from Chris Maynard <christopher.maynard@xxxxxxxxx> 2011-11-14 14:42:28 PST ---
(In reply to comment #0)
> We have a device that performs IPv4 Fragmentation on Ethernet packets.  When
> capturing the output of the device (fragmented packets), wireshark reports TCP
> checksum errors.  Manually inspecting the fragmented packets shows this to not
> be true.  The TCP checksum in the TCP header in the first of the two packet
> fragments is unchanged, and none of the TCP payload data bytes have been
> altered.

To me, it looks like your device is not RFC 791 compliant when it comes to
fragmentation.  According to http://tools.ietf.org/html/rfc791#section-3.2,
"Fragments are counted in units of 8 octets." and "If an internet datagram is
fragmented, its data portion must be broken on 8 octet boundaries."  The first
fragment has a 980 byte payload, which is not divisible by 8.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.