Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

So I was just doing some server side troubleshooting on the network I noticed that 1 of the servers sends all packets with the IP level checksum set to 0. It caught my eye because in my wireshark capture, all packets (no matter what application level protocol, tcp/udp) have the IP layer were marked black (default color setting for wireshark). The server has been working fine, there are no issues with it in terms of network communication, it just caught my eye and seems to be bugging me.

Anyone have any ideas what settings to check on this server? Its a Windows 2003 Standard edition server.

share|improve this question
up vote 2 down vote accepted

Your server just uses TCP checksum offload - the checksum is calculated and changed within the packet by the network hardware (i.e. your NIC). This is a rather common feature. The Wireshark documentation states:

Checksum offloading often causes confusion as the network packets to be transmitted are handed over to Wireshark before the checksums are actually calculated. Wireshark gets these "empty" checksums and displays them as invalid, even though the packets will contain valid checksums when they leave the network hardware later.

So just disable TCP checksum checking in Wireshark preferences if you do not like the black mark on your packets.

share|improve this answer
hmm that was quick! Thanks! – Archit Baweja May 20 '11 at 16:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.