Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I find too many incorrect checksum errors from a TCPDUMP done on a GNU Linux 64bit server. There are close to 50% incorrect chekcsums in the export?

cksum 0xe61f (incorrect (-> 0x8c37)

How can we interpret this data? Does it affect performance a lot?

share|improve this question
Use tcpdump --dont-verify-checksums to ignore these. – Willem Jun 30 '14 at 10:58
up vote 15 down vote accepted

You see the "incorrect" checksums due to a feature called TCP checksum offloading. The checksum fields for outgoing TCP packets are not pre-calculated by the operating system but set to 0 and left for calculation by the NIC processor. The Wireshark FAQ has a more detailed explanation.

share|improve this answer
I saw that but it was specific to "If the packets that have incorrect TCP checksums are all being sent by the machine on which Wireshark is running" and it was not clear how too many legitimate checksum fails would impact network performance. – Vishal Jul 8 '11 at 22:48
You should only see incorrect checksums on packets sent by your machine. This is not specific to Wireshark, any packet capture software working at this level will produce similar results. If you see checksum fails on received packets, there might be a problem indeed - these packets are discarded by the TCP stack and trigger a retransmission as well as congestion control algorithms - which will have a direct impact on data throughput. – the-wabbit Jul 8 '11 at 23:02
The checksum errors were only on the sent packets. Thanks! – Vishal Jul 8 '11 at 23:34
I see incorrect checksums on large incoming SMB packets that need to be re-assembled. tcpdump prints a first packet with "incorrect checksum" along with the comment "WARNING: Packet is continued in later TCP segments". Then there are few more with "incorrect checksum" followed by a comment ""SMB-over-TCP packet:(raw data or continuation?)". I suppose the checksum in the first packet of the set will be correct if all the subsequent packets (which actually have no checksum at the place where tcpdump is grabbing the checksum value) have been reassembled into their whole ≤ 64KiB whole. – David Tonhofer Jan 8 at 16:52

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.