[pcap-ng-format] representing checksum offload in pcapng

Stephen Hemminger stephen at networkplumber.org
Tue Oct 15 21:27:54 UTC 2019


On Tue, 15 Oct 2019 13:39:55 -0700
Guy Harris <guy at alum.mit.edu> wrote:

> On Oct 15, 2019, at 12:44 PM, Stephen Hemminger <stephen at networkplumber.org> wrote:
> 
> > On Tue, 15 Oct 2019 12:27:25 -0700 Guy Harris <guy at alum.mit.edu> wrote:
> >   
> >> On Oct 15, 2019, at 10:02 AM, Stephen Hemminger <stephen at networkplumber.org> wrote:
> >>   
> >>> Maybe something that has ability to indicate good and bad checksum
> >>> for TCP, UDP, and SCTP.    
> >> 
> >> And IP.  
> > 
> > Less of a worry, doing IPv4 checksum in SW is trivial and the header is almost
> > always present.  
> 
> But if an adapter offloads checksum *computation* for *outgoing* packets, recording that the checksum was offloaded would be useful, as sniffers that do their own checksum checking (e.g., Wireshark) will know not to bother to check the checksum of the packet in question, as the copy of the packet delivered to the sniffer won't have the checksum set.
> 
> And that applies to other checksums as well.
> 
> >> Should there be an Interface Description Block option to indicate whether the adapter offloads IP/TCP/UDP/SCTP checksums?
> >> 
> >> If so, is there a need for a per-EPB option to indicate whether the checksum was offloaded - i.e., does an adapter that does offloading either 1) only do offloading in one direction or 2) not do it for all packets?  
> > 
> > That could be there as well, but then you get into GRO, TSO, LRO, tunnels and other offloads.  
> 
> And that's a good thing - it's useful to know if segmentation/reassembly offloading is being done.

The right answer is a complete set of options and having it supported in wireshark.
Don't want to start using custom private options for this (or comments)


More information about the pcap-ng-format mailing list