SGI: Development

That is a perfectly legit point but I was not sure if etherreal would see the bad packet when in promiscuous mode and not be filter it out. I would have hoped the NIC would have dropped it and not interrupted the OS for delivery but I guess you never know. What the app gets and what ethereal sees miht be different - I wasn't sure from the description.

So I was alluding more to the point of being thorough and starting with good known working components which had been tested outside of the environment. It might be a bit tedious but network level problems can involved pretty quickly - although they are an excellent way to learn the fundamentals of ETH, IP, TCP, ARP etc .

I don't recall if tcpdump/ether does this or not but you can get a packet sniffer and see the bad packet (ethernet header as well). You could see the whole packet and armed with this it might guide you to making a more educated stab at what to diagnose. In fact if you can place a linux box in the mix I had some code lying around that will sniff all the packets.

Cheers

Hmm, I believe I know the source of my confusion. First, for a recap, I've two machines [currently connected via a hub]:

A: Indigo2, Irix 6.5.22f, IP 10.0.0.20, netmask 255.0.0.0, capture interface ec0, promiscuous mode
B: Fuel, Irix 6.5.30m, IP 10.0.0.10, netmask 255.0.0.0, capture interface ef0, promiscuous mode

On both A and B, Ethereal 0.9.2 is up and capturing.

Now, if I send a 0-length TCP datagram on, say, some source ports of my own choice [e.g., 1057|22187|33205] from A to port 9 on B, I don't get any Ethereal "incorrect checksum" messages on either A or B.

However, if I send 0-length TCP datagrams on the same source ports from B to port 9 on A, I do get Ethereal "incorrect checksum" messages on B for each of the four packets sent from B to A, although A doesn't report any incorrect checksums.

As it was suggested above in other posts, I changed cables - still the same behavior. I also added in a third machine [an XP laptop running Ethereal 0.10.0] - on it, everything looked ok.

After some experimentations and googling around, I finally came across the FAQs on www.ethereal.com - and there, the answer to Q11.1 gave me a hint to the mystery: the network interface on B might do TCP checksum offloading [re-reading previous posts in this thread, I note that br3d had indeed hinted at that possibility - thanks!]

Checking <ifconfig -a> on B [ef0], I found that the flag CKSUM is indeed set; on A [ec0], this flag is not set - implying that B does TCP checksum offloading but A does not, and, so, it explains why B reported "incorrect checksums" but A did not.

BTW, I also did run <snoop> on A and B concurrently to Ethereal. However, for the above scenarios, <snoop> doesn't report any checksum errors on either A or B at all...