Re: pf corrupting packet checksums?

On 2010/12/29 08:51, Johan Helsingius wrote:
> Running pf on openbsd 4.8 (i386), I find something very strange going on.
> Looking at the log:
> 
> Dec 28 22:23:37.772604 rule 4/(match) [uid 0, pid 28161] pass in on xl2:
> xxx.yyy.zzz.aaa.51717 > foo.bar.www: S [tcp sum ok]
> 3754046362:3754046362(0) win 4095 <mss 1200> (DF) (ttl 64, id 23285, len 44)
> Dec 28 22:23:37.772690 rule 17/(match) [uid 0, pid 28161] pass out on rl0:
> xxx.yyy.zzz.aaa.51717 > foo.bar.www: S [tcp sum ok]
> 3754046362:3754046362(0) win 4095 <mss 1200> (DF) (ttl 63, id 23285, len 44, bad
> cksum 7c0b! differs by 100)
> 
> So the packet is OK going into the firewall, but has a bad checksum going out?
> 
> 	Julf
> 
> 

You are probably offloading checksums to the NIC hardware. If so,
it is normal that tcpdump does this.