Re: [Ethereal-users] confusion about TCP checksum calculation

[Hamish Moffatt <hamish@xxxxxxxxxxxx>]

On Wed, Jan 02, 2002 at 02:42:47AM -0800, Guy Harris wrote:
> On Wed, Jan 02, 2002 at 11:42:58AM +1100, Hamish Moffatt wrote:
> > Oddly enough the IP header has the total length field set to 1500
> > (as captured), which is wrong.
> 
> It's wrong?  Are you certain of that?  Or is the Ethernet frame, as per
> the suggestion in my previous mail, a 1500-byte-plus-14-byte-Ethernet-header
> frame, so that the total length is correct, but truncated to 96 bytes
> due to a small snapshot length in tcpdump or Ethereal?

You're right; I captured the packet with tcpdump with the default
options. I'm still not sure how Ethereal knows that the checksum
was correct on the original packet then - or doesn't it attempt
to check it if some of the packet is missing?


thanks,
Hamish
-- 
Hamish Moffatt VK3SB <hamish@xxxxxxxxxx> <hamish@xxxxxxxxxxxx>