Checksum on Loopback adapter
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 3.6k
- Forks
- 592
- PR merge metrics
- No merged PRs in 30d
Description
I installed NPcap 1.79 some days ago. And it works fine. Thanks!
Except that I noted in tcpdump.exe (or windump.exe) all the received IP (?) packets are printed with a cksum 0:
WINDUMP.EXE: listening on \Device\NPF_Loopback, link-type NULL (BSD loopback), snapshot length 262144 bytes
IP (tos 0x0, ttl 128, id 58580, offset 0, flags [none], proto ICMP (1), length 60, bad cksum 0 (->57ea)!)
127.0.0.1 > 127.0.0.1: ICMP echo request, id 1, seq 36, length 40
IP (tos 0x0, ttl 128, id 58581, offset 0, flags [none], proto ICMP (1), length 60, bad cksum 0 (->57e9)!)
127.0.0.1 > 127.0.0.1: ICMP echo reply, id 1, seq 36, length 40
IP (tos 0x0, ttl 128, id 58582, offset 0, flags [none], proto ICMP (1), length 60, bad cksum 0 (->57e8)!)
127.0.0.1 > 127.0.0.1: ICMP echo request, id 1, seq 37, length 40
...
I'm not sure if this is a feature or short-coming of NPcap or not. Or windump? I cannot imagine.
I have not enabled checksum offload of my physical networks adapters
(if that would make a difference. I think not).
I also see these cksum 0 for loopback traffic inside the Thunderbird email client (when I press About | Check for updates etc.).
To Reproduce
In a Windows-shell (like CMD, yuk!):
start c:\Windows\system32\ping.exe -n 1000 -4 127.0.0.1
windump.exe -vtn -i \Device\NPF_Loopback
and notice all the cksum 0 texts. Seems only the IP-checksums are 0 and the TCP/UDP check-sums are OK.
Expected behavior
I want checksum to appear as they are sent by ping.exe, Thunderbird or whatever.
Screenshots
A start windump.exe --color -vvtni \Device\NPF_Loopback followed by a ping -n 3 -4 127.0.0.1 look like:
- Windows version: Win 10. Build 19045, Home. 22H2 (OS-build 19045.3996)
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce the report with ping.exe and windump.exe on \Device\NPF_Loopback, then trace the NPcap loopback capture path responsible for the IP checksum field. Compare captured loopback packets with the checksum expected from the original ping traffic; done means loopback captures no longer report IP checksums as zero when the packets contain valid checksums.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100