Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I find too many incorrect checksum errors from a TCPDUMP done on a GNU Linux 64bit server. There are close to 50% incorrect chekcsums in the export?

cksum 0xe61f (incorrect (-> 0x8c37)

How can we interpret this data? Does it affect performance a lot?

share|improve this question
Use tcpdump --dont-verify-checksums to ignore these. – Willem Jun 30 '14 at 10:58

1 Answer 1

up vote 14 down vote accepted

You see the "incorrect" checksums due to a feature called TCP checksum offloading. The checksum fields for outgoing TCP packets are not pre-calculated by the operating system but set to 0 and left for calculation by the NIC processor. The Wireshark FAQ has a more detailed explanation.

share|improve this answer
I saw that but it was specific to "If the packets that have incorrect TCP checksums are all being sent by the machine on which Wireshark is running" and it was not clear how too many legitimate checksum fails would impact network performance. – Vishal Jul 8 '11 at 22:48
You should only see incorrect checksums on packets sent by your machine. This is not specific to Wireshark, any packet capture software working at this level will produce similar results. If you see checksum fails on received packets, there might be a problem indeed - these packets are discarded by the TCP stack and trigger a retransmission as well as congestion control algorithms - which will have a direct impact on data throughput. – the-wabbit Jul 8 '11 at 23:02
The checksum errors were only on the sent packets. Thanks! – Vishal Jul 8 '11 at 23:34

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.