Bad Checksums (IP vs TCP)

Hello,

When using the -b option in hping2 to deliberately send a TCP segment
in an IP packet with a bad IP checksum, what actually goes out on the
wire is a packet with a correct IP checksum and a bad TCP checksum. I
see in ip_output.c that the IP checksum is recalculated from scratch
before the packet is transmitted, so that explains why the IP checksum
is correct, but... why is the TCP checksum wrong?

My understanding is that the IP checksum is computed over the IP header
only, while the TCP checksum is computed over the entire TCP segment
(header+data) and the pseudoheader. But the pseudoheader doesn't
contain the IP checksum, so why is the TCP checksum affected by
modification of the IP checksum field?

Does the IP checksum, in fact, get figured into the TCP checksum
calculation under Linux?

Thanks!

G

gg-(E-Mail Removed) wrote:
> Hello,
>
> When using the -b option in hping2 to deliberately send a TCP segment
> in an IP packet with a bad IP checksum, what actually goes out on the
> wire is a packet with a correct IP checksum and a bad TCP checksum. I
> see in ip_output.c that the IP checksum is recalculated from scratch
> before the packet is transmitted, so that explains why the IP checksum
> is correct, but... why is the TCP checksum wrong?
>
> My understanding is that the IP checksum is computed over the IP header
> only, while the TCP checksum is computed over the entire TCP segment
> (header+data) and the pseudoheader. But the pseudoheader doesn't
> contain the IP checksum, so why is the TCP checksum affected by
> modification of the IP checksum field?
>
> Does the IP checksum, in fact, get figured into the TCP checksum
> calculation under Linux?
>
> Thanks!
>
> G
>

The IP chacksum may be off-loaded to the network hardware,
so it will be recalculated before transmission. You can
check by taking a net dump (e.g. Ethereal or tcpdump) on
the sending host and comparing it with the packet at the
receiving host.

--

Tauno Voipio
tauno voipio (at) iki fi

Tauno Voipio <(E-Mail Removed)> wrote:
> The IP chacksum may be off-loaded to the network hardware,
> so it will be recalculated before transmission. You can
> check by taking a net dump (e.g. Ethereal or tcpdump) on
> the sending host and comparing it with the packet at the
> receiving host.

NIC hardware typically offloads the checksum in the TCP or UDP header,
not the IP header checksum. It isn't really worth offloading the IP
header checksum.

rick jones
--
The computing industry isn't as much a game of "Follow The Leader" as
it is one of "Ring Around the Rosy" or perhaps "Duck Duck Goose."
- Rick Jones
these opinions are mine, all mine; HP might not want them anyway...
feel free to post, OR email to rick.jones2 in hp.com but NOT BOTH...

Hello,

Tauno Voipio wrote:
> The IP chacksum may be off-loaded to the network hardware,
> so it will be recalculated before transmission. You can
> check by taking a net dump (e.g. Ethereal or tcpdump) on
> the sending host and comparing it with the packet at the
> receiving host.

Well, the IP checksum isn't really the issue. I know where that gets
recalculated (net/ipv4/ip_output.c). The question is why the TCP
checksum is affected by that change (or alternatively, why it was
affected by the original bad IP checksum). As far as I can tell, the
two computations should be unrelated except for the bytes copied from
the IP header to the TCP checksum pseudoheader, but in packets I'm
looking at, those bytes (the source and destination addresses) don't
change.

So the mystery is why the IP checksum affects the value of the TCP
checksum. It seems like it should be irrelevant. Any ideas?

Thanks!

G