According to The Wireshark FAQ TCP checksum offloading causes checksums for outbound traffic to be calculated incorrectly. On some Linux hosts I see some inbound TCP traffic that is flagged with incorrect checksums:
$ sudo tcpdump -n -vvv dst 10.10.2.20 | grep incorrect
tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 65535 bytes
10.10.2.3.nfs > 10.10.2.20.884: Flags [P.], cksum 0x83fc (incorrect -> 0x2825), seq 3552641460:3552662384, ack 2706746316, win 32806, options [nop,nop,TS val 34524903 ecr 341853002], length 20924
10.10.2.9.ssh > 10.10.2.20.42037: Flags [P.], cksum 0xf39f (incorrect -> 0x2fe6), seq 5174:6902, ack 3086, win 204, options [nop,nop,TS val 263217396 ecr 341868329], length 1728
Where 10.10.2.20 is the external interface on this system.
What conditions can account for incorrect inbound TCP checksums?
0 Answers