Re: Wireshark not reassembling UDP packet

[Guy Harris <guy () alum mit edu>]

On Apr 27, 2012, at 4:35 AM, Kevin Cullimore wrote:

> Is it possible to configure an option to turn the check on/off?

Yes, you disable the IP header checksum validation, as already noted:

> That did it.  Disabling "Validate the IPv4 checksum if possible" caused Wireshark to reassemble the packet.

It's not clear that there would be any use whatsoever to have an option to only disable the check in the reassembly 
code - either your capture has no offloaded checksums and an invalid checksum represents a real error, so you might as 
well leave all the checksum processing enabled, or your capture has offloaded checksums and, for those packets, even 
just saying "this checksum is invalid" is bogus, in which case you might as well disable all the checksum processing.

Ideally

        1) the packet capture mechanism would provide an indication of whether the packet was sent by this host or not, 
and libpcap/WinPcap would supply that (for use in pcap-ng)

and

        2) libpcap/WinPcap would also be able to determine whether the interface was doing IP checksum offloading and 
that could be stored in a pcap-ng file

so that the IP dissector would know whether the packet's checksum is inherently bogus and not bother checking it if it 
is, but

        1) that's not the case now

and

        2) not all captures will come from libpcap/WinPcap-based applications

so the option to disable IP header checksum processing would still be needed.

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe