Anyone ever see a WireShark capture that states the Mac's checksum is bad in its outgoing IP packets? WireShark states the bad checksum "may be caused by IP checksum offload"... Any ideas on what is causing this?
Mac mini, Mac OS X (10.7.4)
Hello, no idea really, but to play Dr Watson for a bit...
Could there be differing MTU requirements somewhere along the line, like sending 1500 Byte packets to a 1492 Byte Router, (1500 minus 8 header Bytes)?
Open Network Utility in Applications>Utilities>Info tab, select Ethernet or whatever interface you use & what is the Link Speed & are there any Errors/Collisions on the right?
Cowb wrote:
Anyone ever see a WireShark capture that states the Mac's checksum is bad in its outgoing IP packets? WireShark states the bad checksum "may be caused by IP checksum offload"... Any ideas on what is causing this?
I haven't seen this myself but can provide a theory.
In the 'old days' all the processing of Ethernet packets was done in software by the computer. However these days it is more and more common for as much processing as possible to be off-loaded to hardware, in this case the Ethernet Network Interface Controller (NIC).
If you are running WireShark on the same computer these packets are coming from then WireShark will be seeing these packets from 'inside' the computer before the leave the computer and go out on to the network via the Ethernet NIC. As they have not yet passed through the NIC they have not yet been processed by the NIC to add the valid checksum and hence WireShark thinks there is an error.
With some Ethernet drivers it is possible to disable the 'off-loading' of the checksum processing i.e. to move it back in to the computer itself, this would be one way of getting round the problem, the other is to simply tell WireShark to ignore this issue. As below.
Checksum Offload means the checksum is calculated by the NIC driver instead of the OS. Therefore, an outgoing packet doesn't have the correct checksum when Wireshark sees it, but does have the correct checksum when the packet is transmitted on the wire. In this case, the checksum error will be seen only on outgoing packets and the error is cosmetic.
One way to make the error go away is to turn off checksum offload in the NIC properties. Remember that you can have IPchecksum offload, TCP checksum offload, or UDP checksum offload.
Another way is to disable the Checksum Errors coloring rule.
(15 Sep '11, 12:39)Jim Aragon
...and yet another way is to disable IP checksum validation. Menu: Edit > Preferences > Protocols > IPv4 > Validate the IPv4checksum if possible (uncheck this box)
Always great to read your posrs John, thanks! 🙂
What was the problem on your network? Did you find the fix? Was it the MTU?
Thanks
Anyone ever see a WireShark capture that states the Mac's checksum is bad in its outgoing IP packets? WireShark states the bad checksum "may be caused by IP checksum offload"... Any ideas on what is causing this?
