Wireshark · Wireshark-dev: Re: [Wireshark-dev] Fwd: Re: [0/7] [PPP]: Fix shared/cloned/non-linear skb bugs (was: malformed capt

[Guy Harris <guy@xxxxxxxxxxxx>]

On Sep 11, 2007, at 11:39 AM, Toralf Förster wrote:

> Running a stable Gentoo kernel 2.6.22-gentoo-r5 now for a while  
> there's only
> one thing left related to this topic.
>
> I'm wondering why some UDP packets of the MS messenger protocol  
> (with the usual
> text like "please click at www.we-destroy-your-computer.com") always  
> have wrong
> check sums regardless whether sniffed at ppp0 or eth0 interface.
>
> But from all UDP packets of this (today) useless protocol only those  
> have wrong
> check sums which are marked as "[Long frame (2 bytes)]" within  
> wireshark.

	...

> BTW the checksum is 0x0000.

If by "wrong checksum" you mean wrong UDP checksum, then, when running  
over IPv4, the UDP checksum is optional - if a UDP packet has no  
checksum, the checksum field has the value 0x0000, and the receiving  
UDP implementation should not check the checksum.

That's probably independent of the "Long frame" issue; we'd have to  
see a capture file with one of those packets to see what's causing  
that issue.