On 7/13/06, Bogdana Botez <[EMAIL PROTECTED]> wrote: > Hi Gerhard, > > I've had the same problem. Maybe this will help you: > http://www.wireshark.org/lists/wireshark-dev/200607/msg00087.html > > BR, > Bogdana > >
At least on Windows, the packet display lights up like a firecracker when TCP checksums are being offloaded. I have a hard time understanding how the first packets could be disassembled correctly and yet have this be a checksum offloading problem. If it was checksum offloading, the high level dissector would be disabled for every packet, right? None of his cases should have worked. Also, how does the offloading work? Would not inbound packets (to the packet capture host) have a proper checksum? In fact, I have this same exact issue with Ethereal and it is not ameliorated in any way by disabling TCP checksums. Something else is happening. It has to do with the "minimum size header" required (in my case, 5 bytes) to determine packet length being split across tcp segments. The strange thing is that the bug only occurs on Windows for me but not Linux. Platform dependent or, more likely, toolchain dependent bug. -- John. _______________________________________________ Wireshark-dev mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-dev
