Note that the approach suggested there of disabling TCP checksum verification in Wireshark does not help for our purposes, because we want to compare packets; having TCP checksums that are different across capture files will still appear as a discrepancy between those capture files even if the checksums’ values are never verified.
If your system performs checksum offloading and you are unable to disable it, other options are available.
The pcapdiff programme described below allows you to ignore TCP and UDP checksum values entirely, in case you have reason to believe that checksum offloading is in use.
You can also perform the capture on a separate machine distinct from the computer that is generating the test traffic - as long as it is connected to the same local area network and is able to see the traffic passing by.
In this case, the capture should be performed in promiscuous mode (see footnote 3 above) and, on a network used by multiple people, extra care should be taken to avoid capturing other users’ communications without their knowledge.
Another form of offloading that can cause packet capture accuracy problems is TCP segmentation offloading, also known as large segment offload.
In TCP segmentation offloading, an Ethernet card, rather than operating system software, splits a large TCP packet into multiple TCP packets.
No comments:
Post a Comment