Re: bad udp cksum 26ff!

From: Kris Kennaway (kris_at_obsecurity.org)
Date: 11/29/05

  • Next message: Arcadiy Ivanov: "FreeBSD <-> Windows XP IPSec Phase 1 Timeout" 
    Date: Mon, 28 Nov 2005 21:49:31 -0500
To: John Palmer <drgnut@hotmail.com>

    On Mon, Nov 28, 2005 at 10:46:38AM -0800, John Palmer wrote:
    > I am running FreeBSD 5.4 p8. I did a tcpdump -vv -i em0. The output
    > produced
    > a "bad udp cksum" with my DNS server. Does anyone know what it means? Or,
    > how I can
    > correct the problem?

    If your NIC is doing checksum offload, tcpdump on the host won't see
    the right checksum, since it's only generated on the way out the door.
    Run tcpdump on another host on the network to verify whether it's
    correct on the wire.

    Kris

  • Next message: Arcadiy Ivanov: "FreeBSD <-> Windows XP IPSec Phase 1 Timeout"

    Relevant Pages

    • Re: bad udp cksum 26ff!
      ... If your NIC is doing checksum offload, tcpdump on the host won't see ... Kris ...
      (freebsd-questions)
    • RE: DDoS attack.
      ... > Subject: Re: DDoS attack. ... > to the source host, or a core router through which it came. ... A portable tcpdump host ...
      (Incidents)
    • Re: DDoS attack.
      ... A "tcpdump -ner" will show you the MAC address or addresses your tcpdump ... to the source host, or a core router through which it came. ... you'll need to trace back to which network on the ... > It got all the signs of a dDoS attack window size is always the same dst ...
      (Incidents)
    • Re: Unable to ping or connect to Internet via Windows ICS
      ... # Host Database ... ::1 localhost.fj-icl.com localhost ... > Start tcpdump on your bsd box ...
      (comp.unix.bsd.openbsd.misc)
    • Re: tcpdump -- non-local traffic not showing
      ... It's my understanding tcpdump puts the ... interface in promiscuous mode, and dmesg seems to confirm this. ... and if tcpdump is running on host a.b.c.x ... Does the interface drop packets with a different mac address, ...
      (freebsd-questions)