Building an http packet in libnet(tcp packet), Please help us as soon as posible. we are stuck!

Question

we are building a NAT program,we change each packet that comes from our internal subnet, change it's source IP address by libnet functions.( catch the packet with libpcap, put it sniff structures and build the new packet with libnet)

over TCP, the syn/ack packets are good after the change, and when a HTTP-GET request is coming, we can see by wireshark that there is an error on the checksum field.. all the other fields are exactly the same as the original packet.

Is anyone knows what can cause this problem? the new checksum in other packets is calculated as it should be.. but in the HTTP packet it doesn't..

Answer 1

Modern ethernet cards can compute the checksum in hardware, so TCP stacks tend to offload the job to the card. As a result, it is quite common for the checksum to be invalid in Wireshark.

Side note: There is an option in Wireshark to validate the checksum:

Edit
  Preferences
    Protocols
      TCP
        Validate the TCP checksum if possible

Turn this off to stop Wireshark nagging you about the checksum.

Answer 2

Is this actually causing a problem - i.e. does the packet with "bad checksum" get dropped or processed incorrectly? Or are you just worried about the "bad checksum" notification? If the packets are processed OK, this may be just checksum offloading and it's nothing to worry about.

Wireshark documentation says:

If the received checksum is wrong, Wireshark won't even see the packet, as the Ethernet hardware internally throws away the packet.