Ethereal-users: Re: [Ethereal-users] reading an "incorrect Checksum" with a Snoop Capture

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Tue, 19 Jul 2005 12:57:10 -0700
julien lecomte wrote:
At the end of a backup, I have an "Incorrect checksum" in a [FIN, ACK] packet sent by the server where snoop is capturing the packets.
"snoop" suggests that the capture was done on a Sun running Solaris, and Suns and Solaris support checksum offloading on at least some adapters (as do many other machines and many other driver/OS networking stack combinations): 

	http://www.ethereal.com/faq#q5.14


Can you tell me how Ethereal is deducing this?
By computing the checksum of the packet and comparing it with the checksum in the packet *as captured* (the FAQ item above explains that, for packets sent by the machine on which the capture program is running, the packet as captured is not the same as the packet as transmitted, if checksum offloading is being done).