Happy new year to all.
I've captured the following frame off my network (contents unimportant):
0000 00 40 95 e1 16 40 00 40 05 69 a2 40 08 00 45 00 .@...@.@ .i.@..E.
0010 05 dc 68 3f 40 00 e5 06 3f 06 c2 49 49 71 cb 0e ..h?@... ?..IIq..
0020 12 0d 00 50 08 db f3 58 ca 5e 02 b6 08 57 80 10 ...P...X .^...W..
0030 fe 88 44 af 00 00 01 01 08 0a 07 79 a6 a0 00 06 ..D..... ...y....
0040 55 32 0e 0a 30 07 1f a0 8c a5 c0 9a 43 fd a6 89 U2..0... ....C...
0050 d0 07 65 30 04 37 50 0c 32 f0 01 1a 80 2f e8 37 ..e0.7P. 2..../.7
I dumped this to a text file, edited by hand, and used text2pcap
to convert it back. I removed the ethernet headers and added
PPP headers instead. (Used text2pcap -l 9). Here's the new dump:
0000 00 21 45 00 05 dc 68 3f 40 00 e5 06 3f 06 c2 49 .!E...h? @...?..I
0010 49 71 cb 0e 12 0d 00 50 08 db f3 58 ca 5e 02 b6 Iq.....P ...X.^..
0020 08 57 80 10 fe 88 44 af 00 00 01 01 08 0a 07 79 .W....D. .......y
0030 a6 a0 00 06 55 32 0e 0a 30 07 1f a0 8c a5 c0 9a ....U2.. 0.......
0040 43 fd a6 89 d0 07 65 30 04 37 50 0c 32 f0 01 1a C.....e0 .7P.2...
0050 80 2f e8 37 ./.7
Ethereal (0.9.0) says this second frame has an incorrect TCP checksum.
I can't figure out why changing the link layer headers causes the
TCP checksum to change? Or is there a bug in the calculation
somewhere?
I'm actually trying to work on something fairly unrelated, but
wanted to work with simple PPP headers instead of ethernet. I
need correct TCP checksums though.
thanks,
Hamish
--
Hamish Moffatt VK3SB <hamish@xxxxxxxxxx> <hamish@xxxxxxxxxxxx>
