2014年11月30日 星期日

[Linux 文章收集] Tcpdump - how to fix the bad checksum problem

Source From Here
Preface
If you capture packets using tcpdump directly from the server, your capture file may contain bad checksums. This is because your OS is currently configured to use the hardware checksum offloading feature of the NIC. When this feature is enabled, expecting the NIC to rewrite the checksums, OS doesn't bother to fill (nor to reset) in the checksum fields. The problem is that tcpdump is capturing the packets before the checksums are rewritten by the NIC.

How-To
Use the following command to turn off the checksum offloading before using tcpdump (on ubuntu).
# sudo ethtool -K eth0 rx off tx off

If you already have a capture file not usable due to the wrong checksums, use the following command to repair the file.
$ sudo tcpreplay -i eth0 -F -w output.cap input.cap

Or
$ sudo tcprewrite -i input.cap -o output.cap -C


沒有留言:

張貼留言

[Git 常見問題] error: The following untracked working tree files would be overwritten by merge

  Source From  Here 方案1: // x -----删除忽略文件已经对 git 来说不识别的文件 // d -----删除未被添加到 git 的路径中的文件 // f -----强制运行 #   git clean -d -fx 方案2: 今天在服务器上  gi...