If the tcpdump is for an outbound packet, this is expected.  Since you 
told the driver that the hardware does checksum, the software doesn't
calculate one;  it just sets it to zero.  Then tcpdump gets its copy of
the packet and dumps that out.  Sometime later, the hardware gets to do 
its thing and calculates the correct checksum.

Get the tcpdump from the receiving side and verify there that the csum 
is good.

On Sat, 19 May 2007, Charlie Allom wrote:

> Hi,
>
> not a ball breaker - as everything still works... afaict.
>
> on my quad intel cards I get all IP packets with bad cksums when
> viewing via tcpdump - pf enabled or not!
>
> capabilities=7ff80<TSO4,IP4CSUM_Rx,IP4CSUM_Tx,TCP4CSUM_Rx,TCP4CSUM_Tx,UDP4CSUM_Rx,UDP4CSUM_Tx,TCP6CSUM_Rx,TCP6CSUM_Tx,UDP6CSUM_Rx,UDP6CSUM_Tx,TSO6>
>
> % ifconfig wm3 tcp4csum udp4csum tso4 ip4csum
> [[wait 34 seconds! poor sockets ]]
>
> enabled=3f80<TSO4,IP4CSUM_Rx,IP4CSUM_Tx,TCP4CSUM_Rx,TCP4CSUM_Tx,UDP4CSUM_Rx,UDP4CSUM_Tx>
>
> then:
>
> 19:05 hadrian:~% sudo tcpdump -enlv -i wm3 |grep bad\ cksum
> [snip]
> 19:05:33.916096 00:15:17:14:ee:19 > 00:00:0c:07:ac:fb, ethertype IPv4 (0x0800), length 66: (tos 0x0, ttl  63, id 60320, offset 0, flags [DF], proto: TCP (6), length: 52, bad cksum 0 (->ea78)!) 193.34.28.23.57249 > 146.101.246.11.3306: ., cksum 0x4e88 (correct), ack 0 win 16746 <nop,nop,timestamp 109171399 3172525958>
> [snip]
>
> what does that mean? cksum 0??
>
> so I port spanned the traffic back to the same NIC, wm4, and of course
> *no* bad cksums.
>
> 19:05 hadrian:~% sudo ifconfig wm3 -ip4csum
> 19:07 hadrian:~% sudo tcpdump -enlv -i wm3 |grep bad\ cksum
> tcpdump: listening on wm3, link-type EN10MB (Ethernet), capture size 96
> bytes
> ^C25313 packets captured
> 104115 packets received by filter
> 77966 packets dropped by kernel
>
> all gone! can someone explain?
>
> http://www.intel.com/network/connectivity/products/pro1000pt_quad_server_adapter.htm
>
> 19:15 hadrian:~% grep wm3 /var/run/dmesg.boot
> wm3 at pci8 dev 0 function 1: Intel PRO/1000 QT (82571EB), rev. 6
> wm3: interrupting at ioapic0 pin 17 (irq 5)
> wm3: PCI-Express bus
> wm3: 65536 word (16 address bits) SPI EEPROM
> wm3: Ethernet address 00:15:17:14:ee:19
> igphy1 at wm3 phy 1: Intel IGP01E1000 Gigabit PHY, rev. 0
>
> -- 
> hail eris
> http://rubberduck.com/
>

----------------------------------------------------------------------
|   Paul Goyette   | PGP DSS Key fingerprint: |  E-mail addresses:   |
| Customer Service | FA29 0E3B 35AF E8AE 6651 |  paul@whooppee.com   |
| Network Engineer | 0786 F758 55DE 53BA 7731 | pgoyette@juniper.net |
----------------------------------------------------------------------