On Thu, 28 Mar 2002, Chris Green wrote: > Guy Harris <[EMAIL PROTECTED]> writes: > > > On Wed, Mar 27, 2002 at 12:30:23PM -0500, Chris Green wrote: > >> My guess is it could be a Darwin driver issue but not sure. > > > > Does the network interface you're using do TCP checksum offloading? > > Probably ( it's Apple's Gigabit -- finding techdocs on it wasn't very > easy though if I registered with them I think they have the driver > available ). > > > This happens with the gigabit cards on the Suns we have at work; > > outgoing packets are reported as having bad checksums by tcpdump and > > Ethereal. (That's why I put into Ethereal an option to disable the > > checksum checking - TCP segment reassembly was not being done for those > > frames, as they didn't have valid checksums.) > > Yeah, we have the same thing in Snort but it took me quite a while to > realize it. My first guess was if they were going to bother doing the > TCP chksumming in hardware, they would be offloading IP too but so > much for intuition :-)
Wow, some of the earlier BroadCom chips screw up hardware checksumming, so you have to turn of TCP checksumming and leave IP on etc, but that sounds crazy. Regards ----- Richard Sharpe, [EMAIL PROTECTED], [EMAIL PROTECTED], [EMAIL PROTECTED] - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
