Ethereal-users: Re: [Ethereal-users] Possibly i found a bug

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <gharris@xxxxxxxxx>
Date: Tue, 25 Apr 2006 23:33:57 -0700
U. Siegel wrote:


possibly i found a bug in my ethereal 0.10.13.
During investigation of a LDAP problem i found one packet truncated due to capture size limitation. 
The cheksum in packet was given w/ "0x602a [incorrect, should be 0x8f9e]".
Because i do not expect a problem related to the checksum given within the packet i would expect a problem in how ethereal comes to checksum in truncated packets.
It might be that this is a packet transmitted by your machine, with checksum offloading.
Or it might be that there's a bug in the checksum code, so that it doesn't just give up on computing the checksum if all the data isn't there.
Is that the IPv4 header checksum, the UDP checksum, the TCP checksum, or some other checksum? Do you have a capture file you can send us that contains a packet with this problem? Does this happen with libpcap 0.99.0?