Toni Mueller <[email protected]> wrote: > today I see tons of these on a 4.6-stable/amd64 machine (sample): > > 17:21:00.848135 esp 1.1.1.1 > 2.2.2.2 spi 0x54d46678 seq 132642 len 84 > (DF) (ttl 64, id 49897, len 104, bad cksum 0! differs by 8b3c)
This looks like outgoing packets on an interface that does IPv4 header checksumming in hardware. tcpdump sees the packets before the checksum is actually filled in. This has nothing to do with IPsec. -- Christian "naddy" Weisgerber [email protected]
