Incorrect TCP checksum

[AyrishGrl]

I am seeing a lot of incorrect TCP checksums between two servers. The sequence is [Unreassembled Packet (incorrect TCP checksu)] --> [TCP previous segment lost] Continuation Data [Unreassembled Packet]. We are getting complaints on performance from some people and I just noticed these on Friday. I am using Ethereal V.0.10.11. This is occuring between an ISA server and an application server. How do I tell if this is a real problem or just the way Ethereal is interpreting the packets?

 

[Helmuth2]

Check if the Checksum Error packets are retransmitted (TCP Sequence number reoccurring). If so this are real errors.

regards
Helmuth

 

[AyrishGrl]

It doesn't look like I am seeing the Sequence numbers of these packets reoccuring so it must just be the way Ethereal is handling the packets. Thanks for the info!

 

[limester]

Bad checksum messages on outgoing packets.
This problem may be caused by the network card's ability to offload the calculation of IP, TCP, and/or UDP checksums from the TCP/IP protocol stack. If the machine sending the packets is also the the sniffer machine, the checksums may appear incorrect if the hardware is calculating the checksums. You may work around this problem by disabling this feature on the network card; however, your network card may not allow you to disable this feature. Check the driver properties on your network card. Look for the checksum offload setting (possibly in the Advanced tab) and if found, disable it.

 

[netwho]

This is commonly observed on Ethereal. I noticed that myselfe with newer versions. Sniffer Pro shouldn't do that, if the right version and card drivers are used.

Regards, netwho

__________________________________
DOS -> Windows -> Linux -> FreeBSD
**** The evolution of a geek ****