[Winpcap-users] TCP CHECKSUM OFFLOAD

[Guy Harris]

On Aug 16, 2005, at 1:46 PM, Sabbiolina wrote:

> Sending appropriate OID to NIC can I switch to offload checksum ?

You'd have to see what the Microsoft documentation, or the vendor for  
the NIC, says.  WinPcap doesn't turn offloading on or off.

> How to analyze those packets ?

"Analyze" in what sense?

If you capture them with WinPcap, then:

	if the packet was sent *to* the machine running the WinPcap-based  
application (WinDump, Analyzer, Ethereal, etc.) from another machine  
with a network adapter that does checksum offloading, then the packet  
will look like any other TCP segment, as the adapter added a checksum  
to it;

	if the packet was sent *by* the machine running the WinPcap-based  
application on an adapter that does checksum offloading, then the  
packet will (as per my mail) probably not have a valid TCP checksum,  
so you can't check the checksum, but everything else about the packet  
should be normal.

> I see an extra word after TCP packet captured and original tcp  
> checksum changed,

What do you mean by "an extra word"?  Do you mean the packet is a  
"word" (2 bytes?  4 bytes?) longer than you expect it to be?