Red Hat Bugzilla – Bug 129823
need to check if checksum computed or not before "bad udp cksum" indicated
Last modified: 2007-11-30 17:10:47 EST
Description of problem:
For the latest kernels (2.6.7-+) with ethernet cards such as
those controlled by the e1000 driver, the card (not the kernel)
computes the IP & UDP checksums, so when tcpdump gets the packet,
they will be incorrect, and tcpdump reports a "bad udp cksum"
for the packet, which can be confusing. Bug 129778 was incorrectly
raised as a kernel bug on this issue.
David Miller, the kernel developer I consulted on this, writes:
The value in the checksum field is the pseudo-checksum, which
the card uses to compute the final checksum. It could be
different on every single packet.
The AF_PACKET socket, which tcpdump uses to capture packets,
does have available a TP_STATUS_CSUMNOTREADY flag it can
check for this purpose. But it is only available when
mmap()'s packet capturing is in use.
So tcpdump should be using this flag to check if the checksum
has been computed before complaining about 'bad udp cksum' .
100% - on every UDP packet
Steps to Reproduce:
1. tcpdump an interface for a card such as Intel 82540EP (e1000
driver) with a 2.6.7+ kernel.
All UDP packets show "[bad udp cksum xxxx!]" .
TCP should not show this error message - perhaps
it should show something like "[cksum not ready]" .
*** Bug 136618 has been marked as a duplicate of this bug. ***
This applies to Ethereal too.