Strange UDP message exchange

Submitted by LegolasV
on September 8, 2005 - 11:28pm

today, when conducting my experiment, I suddenly found an very interesting thing. I open a genome meeting session between an IBM laptop and an ACER computer. The exchanged messagea between them is UDP. The IBM laptop is connected by a cable plugged to its ethernet interface. Then I open ethereal to check the UDP message. And from ethereal I found that that the checksum of all outgoing UDP messages from the IBM laptop are incorrect. So surprise, I use ethereal to check these messages when they arrive the ACER computer and found that all UDP checksum have been changed so they are correct now. After that, I unplug the cable from IBM's ethernet interface. Then I conduct the experiment again but now the IBM laptop use wireless interface. The checksum of outgoing UDP messages from IBM laptop is correct now. I'm interested in this and trying to figure out its reason. I suspect that the driver of ethernet interface on IBM laptop conduct some kind of recalculation transport layer checksum on link layer. Am I right?

Sounds likely, anyway

on
September 9, 2005 - 3:54am

If the hardware does have Tx checksum offload, all checksums on outgoing packets are done by the network card, not the OS. Thus, you'll see invalid checksums on outgoing messages, which are magically corrected upon arrival.

This is nothing to worry about; it just means that the hardware's doing its job.

to continue my experiment, I

on
September 11, 2005 - 11:27am

to continue my experiment, I wrote a simple module, hook into HOOK_LOCAL_OUT hook of netfilter. In that module, I recalculated the checksum so that they are correct now at the source machine. Magically, when packets arrives the destination, checksum of all these packets turn out to be incorrect. So I guess the calculation of checksum at network card depends on the incorrect checksum I see at IP layer. I'm interested in how the incorrect checksum at IP layer is calculated and how the checksum is recalculated at network card. Anybody knows this thing?

checksum is part of checked data

on
September 11, 2005 - 4:38pm

The place where the checksum result comes is zero before adding the checksum, but is part of the area which is checked. That way when doing the check later the result is zero with a correct checksum.

NO, the incorrect checksum is

on
September 11, 2005 - 11:37pm

NO, the incorrect checksum is not zero but something else. for UDP packets exchanging by GNOME meeting session, it is 0x06bc if my memory is good.

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.