Tuesday, November 25, 2008

Wireshark complaints of "bad tcp checksum" on local captures

When using Wireshark to look at network transfers across the localhost interface, you get big "TCP checksum incorrect" messages, and red/black packets in the graphical display. It looks like this comes up because Linux doesn't calculate or check the checksum on localhost packets, which I suppose makes sense as there's no chance of corruption in transit. (Aside from memory errors or bugs, but there's no particular point checking for them just at the time the packet's queued.)

This can be ignored in wireshark by unchecking "Preferences|Protocols|TCP|Validate the TCP checksum if possible".