[Ethereal-users] RE: Checksum Errors when analyzing hp-ux traffic

["Santos, Luiz Sergio" <luiz-sergio.santos@xxxxxx>]

Hello Ronnie,

When I opened the same file that I received from the customer, in two of
my system using ethereal it doesn't show any error in the checksum, so
it points to a problem at ethereal at the customer system, not in the
file (and for sure the problem is not in the system that generated the
trace). I asked the customer to upgrade ethereal to the same version
that mine, but the problem was still the same, so I believe that some
library should still be installed at the customer system. The customer
told me that she had the problem in more than one PC.

The customer has given up working in the problem and decided to ignore
the checksum errors, so I think that we don't have any more how to go
deep in this problem, but I think that in the future some other customer
will ask the same question.

Regards,

Luiz Sergio Santos
HP Brazil 
Response Center Engineer
 

-----Original Message-----
From: ronnie sahlberg [mailto:ronniesahlberg@xxxxxxxxx] 
Sent: quarta-feira, 7 de junho de 2006 06:26
To: Ethereal user support
Cc: Santos, Luiz Sergio
Subject: Re: Checksum Errors when analyzing hp-ux traffic

the most likely cause of incorrect checksums is if you have tcp checksum
offloading enabled on your nic in which case all captured packets that
are sent by the host where you capture data will have an "incorrect"
checksum since you capture the outgoing packets in the stack  before the
packet hits the nic where the checksum will be calculated.


you can disable checksum verification in the preferences for TCP.


since this is so common,   current svn versions of ethereal will not
flag these packets as checksum incorrect    if the packet checksum is
0.
if the packet checksum is not 0 and the reason for the incorrect
checksums is still that you use offloading then your kernel might leak
two bytes of data per frame that is sent (and captured by ehtereal)
which might be a suboptimal setting which the kernel developers may want
to look into.




On 5/22/06, Santos, Luiz Sergio <luiz-sergio.santos@xxxxxx> wrote:
> Hello,
>
> When analyzing traces collected in hp-ux using the command "nettl", 
> ethereal shows it as a bad checksum, but looking the same frame in the

> hp-ux sing the command "netfmt" the checksum is ok.
>
> I work for HP and I cannot duplicate this problem with my system, 
> including analyzing some traces that the customer has sent to me. In 
> my PC running windows XP, I can see the checksum correctly, but the 
> same file at the customer displays "bad checksum". I have already also

> the customer to update the version of ethereal, but it didn't solve 
> the problem. I can read the same file in many systems, with no 
> problem, but the customer is able to duplicate it on many systems
also.
>
> For sure, if in the native hp-ux system the checksum is ok, the 
> problem should be at ethereal, but I have no idea what else I can do 
> to try to help the customer.
>
> Do you have any about this problem?
>
> Regards,
>
> Luiz Sergio
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users
>