From owner-freebsd-net@FreeBSD.ORG  Thu Aug 12 14:45:51 2004
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
Delivered-To: freebsd-net@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 20F1A16A4CF; Thu, 12 Aug 2004 14:45:51 +0000 (GMT)
Received: from fledge.watson.org (fledge.watson.org [204.156.12.50])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id C586B43D31; Thu, 12 Aug 2004 14:45:50 +0000 (GMT)
	(envelope-from robert@fledge.watson.org)
Received: from fledge.watson.org (localhost [127.0.0.1])
	by fledge.watson.org (8.12.11/8.12.11) with ESMTP id i7CEiCQL055720;
	Thu, 12 Aug 2004 10:44:12 -0400 (EDT)
	(envelope-from robert@fledge.watson.org)
Received: from localhost (robert@localhost)i7CEiCCN055717;
	Thu, 12 Aug 2004 10:44:12 -0400 (EDT)
	(envelope-from robert@fledge.watson.org)
Date: Thu, 12 Aug 2004 10:44:12 -0400 (EDT)
From: Robert Watson <rwatson@freebsd.org>
X-Sender: robert@fledge.watson.org
To: Ruslan Ermilov <ru@freebsd.org>
In-Reply-To: <20040812130917.GC24142@ip.net.ua>
Message-ID: <Pine.NEB.3.96L.1040812104300.38103G-100000@fledge.watson.org>
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
cc: net@freebsd.org
cc: Chris Stenton <jacs@gnome.co.uk>
cc: FreeBSD Current <freebsd-current@freebsd.org>
Subject: Re: bad tcp cksum on outgoing packets
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 12 Aug 2004 14:45:51 -0000


On Thu, 12 Aug 2004, Ruslan Ermilov wrote:

> On Thu, Aug 12, 2004 at 12:50:58PM +0100, Chris Stenton wrote:
> > I have just been doing some debugging on my 5.2.1 box and noticed that
> > outgoing tcp packets on the box are coming up with bad checksums on
> > tcpdump. I am using the nge interface.
> > 
> > Here is a sample output.
> > 
> > 12:44:29.458021 0:4:e2:10:60:83 0:c:6e:4e:a0:cc ip 82:
> > hawk.gnome.co.uk.ssh > kite.gnome.co.uk.2167: P [bad tcp cksum 9420!]
> > 2071:2099(28) ack 753 win 65535 (DF) [tos 0x10]  (ttl 64, id 35623, len
> > 68, bad cksum 0!)
> > 
> > 12:44:29.642088 0:c:6e:4e:a0:cc 0:4:e2:10:60:83 ip 60:
> > kite.gnome.co.uk.2167 > hawk.gnome.co.uk.ssh: . [tcp sum ok] 753:753(0)
> > ack 2099 win 64956 (DF) (ttl 128, id 44852, len 40)
> > 
> > 
> > Any ideas whats going on as the packet does not seem to be resent?
> > 
> You don't have hardware checksums enabled, do you?  I barely
> recall they are incompatible with bpf(4).

They're not incompatible per se, but if you're sniffing outgoing packets
and the network interface is calculating the checksum on send, BPF will
see a version of the packet before the checksum is calculated.  If tcpdump
later attempts to verify the checksum, it still won't be calculated in the
copy it sees, and will whine.  It was unclear to me in the above e-mail if
this was a tcpdump of packets on the wire (say, the receiver), or on the
sender before they hit the wire.

Robert N M Watson             FreeBSD Core Team, TrustedBSD Projects
robert@fledge.watson.org      Principal Research Scientist, McAfee Research