On Sep 11, 2007, at 11:39 AM, Toralf Förster wrote:
> Running a stable Gentoo kernel 2.6.22-gentoo-r5 now for a while
> there's only
> one thing left related to this topic.
>
> I'm wondering why some UDP packets of the MS messenger protocol
> (with the usual
> text like "please click at www.we-destroy-your-computer.com") always
> have wrong
> check sums regardless whether sniffed at ppp0 or eth0 interface.
>
> But from all UDP packets of this (today) useless protocol only those
> have wrong
> check sums which are marked as "[Long frame (2 bytes)]" within
> wireshark.
...
> BTW the checksum is 0x0000.
If by "wrong checksum" you mean wrong UDP checksum, then, when running
over IPv4, the UDP checksum is optional - if a UDP packet has no
checksum, the checksum field has the value 0x0000, and the receiving
UDP implementation should not check the checksum.
That's probably independent of the "Long frame" issue; we'd have to
see a capture file with one of those packets to see what's causing
that issue.
_______________________________________________
Wireshark-dev mailing list
[email protected]
http://www.wireshark.org/mailman/listinfo/wireshark-dev
