Many TCP/IP packages with incorrect checksums

[Alexander Skwar]

Hello.

Recently I noticed, that a lot of the TCP/IP packages generated by our HP-UX 11.00 and 11.11 systems have a wrong checksum.

At least that's shown, when I open the nettl trace generated by running

nettl -tn pduin pduout -tm 20000 -e ns_ls_ip -f /tmp/nettl

in Ethereal.

The ratio of packages with wrong checksums is close to 50%.

I'm hesitating to make such a trace file publically available, as it might contain passwords or other sensitive data.

Is this something that I need to worry about?

Alexander Skwar

[Steven E. Protter]

Shalom Alex,

do not post the trace file. perhaps post a few snippets.

Its only something to worry about if there is a network congestion problem or the HP servers are providing poor response time.

It may be a sign of poor configuration of the networking environment or the NIC cards being flakey. You can use cstm or mstm to check the cards.

SEP

[Alexander Skwar]

I'm under the impression, that the package is captured "too early" and the checksum is calculated at a later step?

I do think so, because when I sniff the traffic from a different host, the packages come in with a correct checksum. So, it seems that the checksum is only wrong on the system itself.

Is that possible?

[rick jones · Accepted solution]

Not only possible, but probable, based on what I said in my followup to your post in netnews on this same topic. (Ah the joys of parallel venues...not)

If the NIC being used supports ChecKsumOffload and it is enabled, outbound traffic sniffed on the host will show incorect checksums because the checksum has not been calculated.

The checksum gets calculated by the NIC, once the NIC has DMA'd the packet from the host.

Packet tracing for outbound happens when the packet is first given to the driver. It cannot happen after the NIC has transmitted the packet because stuff like interrupt avoidnace and transmit completion bundling would mean you woudl see the ping reply before the ping request and the packet trace would then be useless. And even _if_ the packet tracing for outbound traffic happened after the NIC transmitted the packet, the checksum would still be wrong because the NIC will update the checksum field in _its_ copy of the packet, not the copy in the host memory.

You only need to concern yourself with checksum errors reported by netstat -s. Or, if you need to have pristine packet traces from the sending host, you can - at least on later versions of the Gigabit drivers - disable checksum offload. However, that will increase CPU utilization - the checksum calculation being done in the host - and it will preclude using "large send" (aka TSO) since that functionality on the NIC depends on CKO being present. (That would be an 11iv2 only issue I think since TSO is only there and later, although it _may_ be on 11i v1, I know it isn't on 11.0)

[Alexander Skwar]

Thanks a lot for your answers. This was really helpful.

[Alexander Skwar]

Question answered.