Guy Harris <[EMAIL PROTECTED]> writes: > On Wed, Mar 27, 2002 at 12:30:23PM -0500, Chris Green wrote: >> My guess is it could be a Darwin driver issue but not sure. > > Does the network interface you're using do TCP checksum offloading?
Probably ( it's Apple's Gigabit -- finding techdocs on it wasn't very easy though if I registered with them I think they have the driver available ). > This happens with the gigabit cards on the Suns we have at work; > outgoing packets are reported as having bad checksums by tcpdump and > Ethereal. (That's why I put into Ethereal an option to disable the > checksum checking - TCP segment reassembly was not being done for those > frames, as they didn't have valid checksums.) Yeah, we have the same thing in Snort but it took me quite a while to realize it. My first guess was if they were going to bother doing the TCP chksumming in hardware, they would be offloading IP too but so much for intuition :-) -- Chris Green <[EMAIL PROTECTED]> "Yeah, but you're taking the universe out of context." - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
