On Sun, 06 Dec 2009 20:16:50 +0100 Helmut Eller heller@common-lisp.net wrote:
I was able to produce a network capture with tshark. I changed swank.lisp so that it always creates the port on 4444 and captured with tshark -i lo -w /tmp/x.dump port 4444
The file is attached below and can be opened with Wireshark. Some TCP packets have a "TCP CHECKSUM INCORRECT". This seems very odd to me. Does somebody know what it means?
The text results of tcpdump (especially using -nvvxX flags) or a binary tcpdump result would be easier for me (and perhaps others?) to read.
When I encountered packet checksum errors here it was due to a card/driver specific TCP hardware acceleration feature when enabled, or hardware problems, although a faulty software packet translator or IP stack bug is not impossible... Since your test appears to be local, I doubt NIC TCP acceleration to be the problem however.
In case your question was litteral about "what it means?" (sorry for stating the obvious if it wasn't), a TCP checksum is wrong for a packet when it doesn't match the actual checksum of its payload (indicating it was probably corrupted in transit, or wrongly calculated), and this is rarely calculated/verified at the application layer, except by userland packet-level analysis/manipulation tools.
It could even be a tshark-specific problem...