Header checksum error?

Yesterday was our monthly ISSA meeting and the presenter was presenting WireShark and all it's features. I honestly didn't realize how robust Wire Shark is and everything you can do with it. Anyhow, I got excited about it and just fired it up. One thing that puzzles me is all the checksum errors I'm getting. How normal is that? They are mostly coming from my 2003 server.

attachment.php?attachmentid=918&stc=1&d=1299349410

attachment.php?attachmentid=918&stc=1&d=1299349410

Find more posts tagged with

Free for TechExams community: Cybersecurity salary guide

Compare cert salaries and plan your next career move

Button

Comments

Monkerz

Set "task offload" to "No" in the NIC driver advanced options of the sniffing PC.

Rerun your capture.

Note- I googled.

I've never seen this before.

Met44

Usually this happens to outbound packets on a device with the TCP or UDP offload engine enabled, when you are sniffing on the same machine. This is not a problem, since the checksum is not inserted until the packet gets to the network card driver and any sniffing occurs before then. If you sniffed on a hub or something, the checksums would be valid.

In this case, however, I'm guessing the checksum shown is in a UDP header. The UDP checksum is optional, and a value of 0 indiciates that it is not being used. Wireshark must not check for a value of 0 as a special case, but any machine receiving such a packet should have no problem processing it.

veritas_libertas

Thanks guys!