Re: [Ethereal-users] confusion about TCP checksum calculation

[Guy Harris <gharris@xxxxxxxxx>]

On Wed, Jan 02, 2002 at 11:42:58AM +1100, Hamish Moffatt wrote:
> Oddly enough the IP header has the total length field set to 1500
> (as captured), which is wrong.

It's wrong?  Are you certain of that?  Or is the Ethernet frame, as per
the suggestion in my previous mail, a 1500-byte-plus-14-byte-Ethernet-header
frame, so that the total length is correct, but truncated to 96 bytes
due to a small snapshot length in tcpdump or Ethereal?