Re: [tcpdump-workers] capturing packets with CRC errors

[Michael Ang]

I of course meant checksum instead of CRC for IP and TCP. Looking at the code for tcpdump it seems that those checksums are passed intact through pcap as they appear on the wire (i.e. packets are not rejected based on IP or TCP checksum errors).

Whether I need to worry too much about the TCP checksum in practice is a different question, I guess.

- Mike.

Michael Ang wrote:

Are packets with CRC errors captured by default on FreeBSD? Is this hardware dependent?

I found a question about this in the Ethereal FAQ that seems to hint packet with bad CRCs aren't captured[1]. But I guess this only applies to CRC errors at the link level?

My program deals with TCP packets and I want to know if packets with CRC errors at the IP and TCP level are rejected. Verifying the IP header CRC seems feasible, but not TCP since it may be too expensive and I want to set a small snaplen.

Thanks,
- Mike.

[1] http://ethereal.ntop.org/faq.html#q4.17

-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe