Wireshark-dev: Re: [Wireshark-dev] Problem with tcp_dissect_pdus
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Ulf Lamping <ulf.lamping@xxxxxx>
Date: Thu, 13 Jul 2006 14:24:03 +0200
> After disabling the check of the TCP checksum it works.
> 
> Can anybody explain this behaviour?
> That looks like a bug for me.
> 

See http://www.wireshark.org/docs/wsug_html_chunked/ChAdvChecksums.html about checksum offloading in general. Windows XP machines will usually use checksum offloading (if the driver supports it, and it usually does).

The reassembling code won't "see" packets that contain wrong checksums, to avoid "poisoning" the internal reassembly "database". Keep in mind, that the reassembling code was written before checksum offloading become common, so this was ok at that time.

If you switch off checksum checks, reassembling will "see" all packets.

Well, this is not a bug in the common sense (the code does what's intended). However, with current Windows systems (and when I remember right some Unixes use offloading too), it's questionable if this is the best way to handle this ...

Regards, ULFL
______________________________________________________________
Verschicken Sie romantische, coole und witzige Bilder per SMS!
Jetzt bei WEB.DE FreeMail: http://f.web.de/?mc=021193