Re: [Ethereal-users] confusion about TCP checksum calculation

[Hamish Moffatt <hamish@xxxxxxxxxxxx>]

On Tue, Jan 01, 2002 at 10:08:02PM +1100, Hamish Moffatt wrote:
> 0000  00 40 95 e1 16 40 00 40  05 69 a2 40 08 00 45 00   .@...@.@ .i.@..E.
> 0010  05 dc 68 3f 40 00 e5 06  3f 06 c2 49 49 71 cb 0e   ..h?@... ?..IIq..
> 0020  12 0d 00 50 08 db f3 58  ca 5e 02 b6 08 57 80 10   ...P...X .^...W..
> 0030  fe 88 44 af 00 00 01 01  08 0a 07 79 a6 a0 00 06   ..D..... ...y....
> 0040  55 32 0e 0a 30 07 1f a0  8c a5 c0 9a 43 fd a6 89   U2..0... ....C...
> 0050  d0 07 65 30 04 37 50 0c  32 f0 01 1a 80 2f e8 37   ..e0.7P. 2..../.7
> 

[...]

> Ethereal (0.9.0) says this second frame has an incorrect TCP checksum.
> I can't figure out why changing the link layer headers causes the
> TCP checksum to change? Or is there a bug in the calculation
> somewhere?

Stranger yet; I fed the exact same packet as captured back in
(text2pcap with no -l option) and got the same checksum error
in the decode.

Hamish
-- 
Hamish Moffatt VK3SB <hamish@xxxxxxxxxx> <hamish@xxxxxxxxxxxx>