When WireShark captures packets, the TCP packet may be caused by ip checksum offload

When we captured packets with WireShark recently, we found that an error occurred in the TCP packet: IP Checksum Offload. After reading the information, we finally found the cause.

In summary, the packet captured by wireshark prompts a Checksum error because it intercepts the overfilled checksum of the operating system, while the Gigabit Nic enables Checksum Offload, the calculation work will be handed over to the NIC. The NIC finally calculates the correct checksum and sends it out.

That is, the checksum was previously implemented by the system protocol stack and is now implemented by the NIC hardware, which can save a lot of CPU resources. Microsoft's test shows that it can save up to 30% of CPU resources. Ibm aix documentation pointed out: for PCI interface Gigabit Nic is not as good as let the CPU above MHz to calculate the checksum, And the PCI-X Gigabit Nic can achieve line speed after enabling this, this saves CPU resources.

In windows, you can open the Device Manager and find the corresponding nic. in the Advanced properties of the NIC, change the checksum offload attribute to none.

In linux, run the ethtool command to disable checksum offload. The specific command is as follows:

# Ethtool-K eth0 tx off rx off

In this way, the inspection is not completed by the NIC hardware, but is implemented by the system, and no error is reported.