TCP CHECKSUM INCORRECT

[r***@gmail.com]

Hi
during an ftp I get a lot of TCP CHECKSUM INCORRECT.

Do you have an idea why ?

tks

[Patrick Klos]

Post by r***@gmail.com
Hi
during an ftp I get a lot of TCP CHECKSUM INCORRECT.

What makes you think so?

Post by r***@gmail.com
Do you have an idea why ?

If you're using tcpdump, Ethereal or WireShark (or similar) to look at the
packets going between your box and your FTP server, then you're probably
seeing the effect of offloaded TCP checksum generation (TCP checksums are
generated by the ethernet adapter so they may look bad if you look at them
before the packet is sent to the ethernet adapter)? Disable TCP checksum
offload to see if the problem is no longer reported.

Patrick Klos
========= For LAN/WAN Protocol Analysis, check out PacketView Pro! =========
Patrick Klos Email: ***@klos.com
Klos Technologies, Inc. Web: http://www.klos.com/
============================================================================

[r***@gmail.com]

Post by Patrick Klos

Post by r***@gmail.com
Hi
during an ftp I get a lot of TCP CHECKSUM INCORRECT.

What makes you think so?

Post by r***@gmail.com
Do you have an idea why ?

If you're using tcpdump, Ethereal or WireShark (or similar) to look at the
packets going between your box and your FTP server, then you're probably
seeing the effect of offloaded TCP checksum generation (TCP checksums are
generated by the ethernet adapter so they may look bad if you look at them
before the packet is sent to the ethernet adapter)? Disable TCP checksum
offload to see if the problem is no longer reported.
Patrick Klos
========= For LAN/WAN Protocol Analysis, check out PacketView Pro! =========
Klos Technologies, Inc. Web: http://www.klos.com/
===========================================================================�=

tks

how can I "Disable TCP checksum offload to see if the problem is no
longer reported" ?
do you mean on the NIC ?
ric

[b***@encompasserve.org]

Post by Patrick Klos

Post by r***@gmail.com
Hi
during an ftp I get a lot of TCP CHECKSUM INCORRECT.

What makes you think so?

Post by r***@gmail.com
Do you have an idea why ?

If you're using tcpdump, Ethereal or WireShark (or similar) to look at the
packets going between your box and your FTP server, then you're probably
seeing the effect of offloaded TCP checksum generation (TCP checksums are
generated by the ethernet adapter so they may look bad if you look at them
before the packet is sent to the ethernet adapter)? Disable TCP checksum
offload to see if the problem is no longer reported.

This explanation could fit if the problem is packets leaving the box
where you are running tcpdump and going toward the wire.

There's a similar explanation available if the problem is packets coming
into the box where you are running tcpdump.

The box on the far side may be offloading the checksum computation into
an adapater that's doing it wrong. We had a number of Windows
servers doing this intermitttently and cured it by telling them to
compute the checksums in software rather than trust broken
drivers/adapters to do it. 30-50% intermitttent packet loss is no joke.

[Craig Partridge]

Post by r***@gmail.com
during an ftp I get a lot of TCP CHECKSUM INCORRECT.

How are you learning that the checksum is wrong? Is it because the
count of packets received in error in your driver shows problems or a
long message is recording bad packets? Or are you using a packet trace
tool (in which case, the adapter may be miscomputing the checksum of
the "raw" packets).

If the actual, on-the-wire, packets have errors then the usual cause is
that the data was good when checksummed but got trashed after the
checksum was done -- usually by the sending network adapter card.

If you're feeling really ambitious, compare a packet with a bad checksum
with its retransmission with a good checksum. If you see on a 16-bit
boundary or data trashed from a starting point to the end of a packet,
you've probably got a bad adapter (16-bit data line good bad, trashed
data from a busted data pointer...). The problem could be more complex
but that's a good place to start.

Craig

[r***@gmail.com]

Post by Craig Partridge

Post by r***@gmail.com
during an ftp I get a lot of TCP CHECKSUM INCORRECT.

How are you learning that the checksum is wrong? Is it because the
count of packets received in error in your driver shows problems or a
long message is recording bad packets? Or are you using a packet trace
tool (in which case, the adapter may be miscomputing the checksum of
the "raw" packets).
If the actual, on-the-wire, packets have errors then the usual cause is
that the data was good when checksummed but got trashed after the
checksum was done -- usually by the sending network adapter card.
If you're feeling really ambitious, compare a packet with a bad checksum
with its retransmission with a good checksum. If you see on a 16-bit
boundary or data trashed from a starting point to the end of a packet,
you've probably got a bad adapter (16-bit data line good bad, trashed
data from a busted data pointer...). The problem could be more complex
but that's a good place to start.
Craig

I see the problem sniffing with wireshark and the problem is mentioned
as "possible TCP OFFLOAD PROBLEM?"
I'm trying to disable the tcpoffload on the nic to see if it's better.
Any other idea?

Ric