What is checksum offloading
From http://www.wireshark.org/docs/wsug_html_chunked/ChAdvChecksums.html
The Checksum calculation might be done by the Network Driver, protocol driver or even in hardware.
For example: the Ethernet transmitting hardware calculates
Ethernet CRC32 checksum and the processing ing hardware validates this
Checksum. If the specified ed checksum is wrong Wireshark won't even see
The packet, as the Ethernet hardware internally throws away the packet.
Higher level checksums are "traditionally" calculated by
Protocol implementation and the completed packet is then handed over
The hardware.
Recent network hardware can perform advanced features such as IP
Checksum calculation, also known as checksum offloading. The Network
Driver won't calculate the checksum itself but will simply hand over
Empty (zero or garbage filled) checksum field to the hardware.
Checksum offloading often causes confusion as the network packets to be
Transmitted are handed over to Wireshark before the checksums are
Actually calculated. Wireshark gets these "empty" checksums and
Displays them as invalid, even though the packets will contain valid
Checksums when they leave the network hardware later.
Checksum offloading can be confusing and having a lot of [invalid]
Messages on the screen can be quite annoying. As mentioned above,
Invalid checksums may lead to unreassembled packets, making
Analysis of the packet data much harder.
You can do two things to avoid this checksum offloading problem:
* Turn off the checksum offloading in the network driver, if this option is available.
* Turn off checksum validation of the specific protocol in the wireshark preferences.
How to turn off checksum offload?
In under Linux, check the status of offload parameters for the interface (eth0 ):
Ethtool-K eth0
Then turn off TX-checksumming:
Ethtool-K eth0 TX off
Refer to man page of ethtool for more.