nmap / nmap/npcap

Checksum on Loopback adapter

Open
#715 4 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
C
Stars
3.6k
Forks
592
PR merge metrics
No merged PRs in 30d

Description

I installed NPcap 1.79 some days ago. And it works fine. Thanks!
Except that I noted in tcpdump.exe (or windump.exe) all the received IP (?) packets are printed with a cksum 0:

WINDUMP.EXE: listening on \Device\NPF_Loopback, link-type NULL (BSD loopback), snapshot length 262144 bytes
IP (tos 0x0, ttl 128, id 58580, offset 0, flags [none], proto ICMP (1), length 60, bad cksum 0 (->57ea)!)
    127.0.0.1 > 127.0.0.1: ICMP echo request, id 1, seq 36, length 40
IP (tos 0x0, ttl 128, id 58581, offset 0, flags [none], proto ICMP (1), length 60, bad cksum 0 (->57e9)!)
    127.0.0.1 > 127.0.0.1: ICMP echo reply, id 1, seq 36, length 40
IP (tos 0x0, ttl 128, id 58582, offset 0, flags [none], proto ICMP (1), length 60, bad cksum 0 (->57e8)!)
    127.0.0.1 > 127.0.0.1: ICMP echo request, id 1, seq 37, length 40
...

I'm not sure if this is a feature or short-coming of NPcap or not. Or windump? I cannot imagine.
I have not enabled checksum offload of my physical networks adapters
(if that would make a difference. I think not).

I also see these cksum 0 for loopback traffic inside the Thunderbird email client (when I press About | Check for updates etc.).

To Reproduce

In a Windows-shell (like CMD, yuk!):

start c:\Windows\system32\ping.exe -n 1000 -4 127.0.0.1
windump.exe -vtn -i \Device\NPF_Loopback

and notice all the cksum 0 texts. Seems only the IP-checksums are 0 and the TCP/UDP check-sums are OK.

Expected behavior

I want checksum to appear as they are sent by ping.exe, Thunderbird or whatever.

Screenshots

A start windump.exe --color -vvtni \Device\NPF_Loopback followed by a ping -n 3 -4 127.0.0.1 look like:

npcap-loopback

  • Windows version: Win 10. Build 19045, Home. 22H2 (OS-build 19045.3996)

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce the report with ping.exe and windump.exe on \Device\NPF_Loopback, then trace the NPcap loopback capture path responsible for the IP checksum field. Compare captured loopback packets with the checksum expected from the original ping traffic; done means loopback captures no longer report IP checksums as zero when the packets contain valid checksums.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
networking
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.