Detect Incorrect Checksum
Bookmark this page:
 Yahoo!
 Google
 Windows Live
 del.icio.us
 digg
 Netscape
|
|
|||||||||||||||||||
|
Posted by Rahan on July 27, 2006, 12:17 pm
Please log in for more thread options I have some hosts (windows and Solaris) connected to Cisco Switch 2950. When i capture traffic with sniffer, i can see a problem of incorrect checksum in packet and i know why (i disabled offload in my network card and all work fine). But when i have checksum error, i don't see anything in the switche. (no input, no output, no crc... no errors) !!! How can i detecte checksum error whitout sniffing directly in the hosts ?? ThankYou very much Best Regards Rahan | |||||||||||||||||||
|
Posted by Walter Roberson on July 27, 2006, 12:37 pm
Please log in for more thread options >I have some hosts (windows and Solaris) connected to Cisco Switch 2950.
>When i capture traffic with sniffer, i can see a problem of incorrect
>checksum in packet and i know why (i disabled offload in my network card and >all work fine). >But when i have checksum error, i don't see anything in the switche. (no
>input, no output, no crc... no errors) !!! When you have checksums offloaded to your network card, then a sniffer on the host sniffs the packets -before- they go to the network card, and so sniffs the unadjusted checksums. The network card then fixes the checksums and sends out the corrected packet. I'm not sure from your posting whether you did not know that, or if you have reason to believe there are checksum errors -after- the NIC rewrites the checksum (e.g., somewhere in transit between the NIC and the receiving end) ? | |||||||||||||||||||
|
Posted by Rahan on July 27, 2006, 1:01 pm
Please log in for more thread options
>
> >I have some hosts (windows and Solaris) connected to Cisco Switch 2950.
>
> >When i capture traffic with sniffer, i can see a problem of incorrect
and
> >checksum in packet and i know why (i disabled offload in my network card > >all work fine).
>
> >But when i have checksum error, i don't see anything in the switche. (no
> >input, no output, no crc... no errors) !!! >
> When you have checksums offloaded to your network card, then a > sniffer on the host sniffs the packets -before- they go to the network > card, and so sniffs the unadjusted checksums. The network card then > fixes the checksums and sends out the corrected packet. > Thank You for your answer. if what you said is true, so, i will find all packets with checksum error !! it's not in my case ! i have only some packets with checksum error, not all. > I'm not sure from your posting whether you did not know that, or if
> you have reason to believe there are checksum errors -after- the > NIC rewrites the checksum (e.g., somewhere in transit between the > NIC and the receiving end) ? And when i disabled offloading in my NIC, i don't have checksum error. And when i disabled offloading in my NIC, i don't have network problem (disconnexion client, lost data... etc) Best Regards Rahan | |||||||||||||||||||
|
Posted by Walter Roberson on July 27, 2006, 2:01 pm
Please log in for more thread options
>> When you have checksums offloaded to your network card, then a
>> sniffer on the host sniffs the packets -before- they go to the network >> card, and so sniffs the unadjusted checksums. The network card then >> fixes the checksums and sends out the corrected packet. >if what you said is true, so, i will find all packets with checksum error !!
>it's not in my case ! >i have only some packets with checksum error, not all. When checksums are offloaded to the driver, then for any particular protocol, the checksum field stored in the packet (the one that is sniffed) will be either a constant or whatever trash happens to be handy. Either way, by chance sometimes that is going to be the correct checksum: in order for the value to *never* be right, the drivers would have to calculate the checksum and then deliberately put in something it knew to be wrong. Another thing you might observe is that different protocols involve different numbers of checksums. With checksum downloading turned on, there may be a pattern of incorrect checksums -- e.g., it might happen for all TCP packets but not for other packets. >And when i disabled offloading in my NIC, i don't have network problem
>(disconnexion client, lost data... etc) It sounds like the easiest solution is to leave checksum downloading disabled ;-) If the NIC is not processing checksum regeneration properly, then it could be having other difficulties that might lead to the bad packets never leaving the NIC. You need try snooping the data -after- it leaves the NIC, such as by using SPAN or RSPAN to "mirror" the switchport data over to another port for analysis. | |||||||||||||||||||
| Similar Threads | Posted |
| Detect Incorrect Checksum | July 27, 2006, 12:17 pm |
| Cisco 877W shows incorrect DSL attenuation | July 3, 2006, 7:26 pm |
| IOS checksum error... | November 20, 2008, 9:32 am |
| Pix 515 checksum error after update | October 13, 2005, 8:52 am |
| Ip Header Checksum Error | April 19, 2006, 8:18 am |
| validate-checksum Command | November 29, 2007, 9:02 am |
| How to detect availability | July 5, 2005, 1:11 pm |
| How to detect interface? | February 27, 2008, 9:21 am |
| Prevent\Detect Dual Homing | August 21, 2006, 3:28 am |
| Reset VOIP Call (no media detect) | October 18, 2005, 10:03 pm |
| Using snmp traps to detect broadcast storms | March 20, 2008, 12:00 pm |
| Some wireless clients cannot detect my unbroadcast Aironet AP | July 3, 2008, 11:21 pm |