Why is it in this day and age that wireshark is still telling me that an Ethernet/TCP/UDP checksum of 0x00000000 is an error? Documentation right from the wireshark website says it has to do with checksum offloading and I need to change a setting in wireshark to stop validating checksums. Why doesn't wireshark automatically see 0x00000000 and mark it as a Note or less in the expert infos so if there is actually a checksum error it doesn't get missed? I do realize I can create a display filter for this, I just feel I shouldn't have to. asked 10 Nov '14, 06:47  ex1580 |
One Answer:
Because different drivers\OS's will place different values in the uninitialized field. Should we just guess that some checksums are not an error and mark them as "possible error"? Apart from that, feature requests are best directed at the Wireshark Bugzilla marking the item as an "enhancement". answered 10 Nov '14, 06:51  grahamb ♦ |
Grahamb, thanks for the answer, I will post a feature request over on bugzilla.