On Wed, Mar 27, 2002 at 12:30:23PM -0500, Chris Green wrote: > My guess is it could be a Darwin driver issue but not sure.
Does the network interface you're using do TCP checksum offloading? If so, the networking stack might not compute the checksum on outgoing packets, so that when such a packet is handed to the driver, it has a possibly-invalid checksum. The driver would then hand the packet to BPF, and libpcap would pick it up and hand it to tcpdump/snort/Ethereal/etc., which would get a packet with a bad checksum. This happens with the gigabit cards on the Suns we have at work; outgoing packets are reported as having bad checksums by tcpdump and Ethereal. (That's why I put into Ethereal an option to disable the checksum checking - TCP segment reassembly was not being done for those frames, as they didn't have valid checksums.) If not, this is still probably a driver or networking stack problem elsewhere, not a libpcap or application problem. - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
