Wireshark-users: Re: [Wireshark-users] TCP checksum offloading and non-zero checksums
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 23 Nov 2018 16:02:41 -0800
On Nov 23, 2018, at 3:57 PM, Vic Chester <vcsubscriptions@xxxxxxxxx> wrote:

> I was under the impression that if TCP checksum offloading occurs, the actual TCP checksum would be zero. Can anyone confirm?

I would not assume that; the networking stack might just not bother initializing the checksum field to zero before handing a packet to a NIC doing checksumming.

> The reason I ask is because I have a capture from a Centos 7 VM where several packets (73) are reported as having incorrect TCP checksums. The actual checksums are not zero however, and some of them when have replies to them. If the checksum was really incorrect the ip stack of the receiver should have discarded the packet.

And if this is a "virtual NIC" that just moves packets from one VM to another, it might not even bother generating a checksum - or checking it on the other side.  If *memory* isn't reliable, you have bigger problems than just "TCP connections between VMs might get corrupted data"....