> More to the point, only the first fragment *contains* the checksum.
> This is never expected to work, and tcpdump probably shouldn't even
> try.

Yes, of course - silly me.

I noticed when comparing the two dumps (one working, on the NAT machine, one
not working, from behind that) - the bad tcp cksum message is there for the
working case too, but only once. Seems like some ACKs missing or wrong in the
behind-NAT case, so the peer resends these fragments over and over again
until giving up.


Martin