[pcap-ng-format] representing checksum offload in pcapng

[Guy Harris]

On Oct 15, 2019, at 10:02 AM, Stephen Hemminger <stephen at networkplumber.org> wrote:

> Is there any proposed option for representing checksum offload
> in an enhanced packet block?

There isn't one yet.

> This matters when packet is truncated by snap length.

This also matters when the packet *isn't* truncated by the snapshot length.

> Maybe something that has ability to indicate good and bad checksum
> for TCP, UDP, and SCTP.

And IP.

> Could even do inner/outer checksums.
> The default should be that if option is not present, that
> means no checksum offload information is available and
> the checksum status is unknown.

Should there be an Interface Description Block option to indicate whether the adapter offloads IP/TCP/UDP/SCTP checksums?

If so, is there a need for a per-EPB option to indicate whether the checksum was offloaded - i.e., does an adapter that does offloading either 1) only do offloading in one direction or 2) not do it for all packets?

If an adapter does offloading, can it be put into a mode where it doesn't drop incoming packets with a bad checksum, but provides them to the host either to indicate the error or to provide the packets to sniffers?  If so, then, yes, a per-packet option to indicate the bad checksums would be useful.