Re: IPFilter 4.1.33

Jim Klimov <[email protected]> Fri, 11 Sep 2009 19:36:55 +0400

Newsgroups	gmane.comp.security.firewalls.ipfilter
Organization	JSC COS/HT
Message-ID	<[email protected]>

Steve Clark wrote:
 > DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 10
 > 5 bad IP checksums seen in 5 packets

Sorry Steve, I must have overlooked this.

So DHCP Client also sees broken packets... Perhaps it is in some
logical position between the NIC and IPF like a sniffer would be,
so turning off checksum offload may help anyway.

I guess the more general solution would be a configuration flag
for IPF to not recalculate checksums for packets on specified
interfaces. After all, to fix the problem we're turning of the
acceleration feature which relieves our CPUs...

//Jim