TCP capture in a virtual machine shows incorrect TCP checksums

Products

• VMware vSphere ESXi

Issue/Introduction

A network traffic capture within a virtual machine using Wireshark or tcpdump shows large numbers of incorrect TCP checksums.

This issue may occur if the network traffic is captured before the checksum is calculated.

Environment

VMware ESXi 4.1.x Embedded
VMware ESX Server 3.0.x
VMware ESX Server 2.5.x
VMware vSphere ESXi 5.1
VMware vSphere ESXi 5.5
VMware ESXi 4.0.x Installable
VMware ESXi 3.5.x Installable
VMware ESX Server 3.5.x
VMware ESXi 4.0.x Embedded
VMware vSphere ESXi 5.0
VMware ESX 4.0.x
VMware ESX 4.1.x
VMware ESXi 3.5.x Embedded
VMware ESXi 4.1.x Installable

Resolution

To resolve this issue, check if the packets that have incorrect TCP checksums are sent by the virtual machine on which the capture is running. When virtual machines use TCP checksum offloading, the TCP checksum is added to the packet by the network interface and not by the TCP/IP stack of the operating system. This means that the network traffic is captured before the checksum is calculated and, therefore, the checksum is incorrect. In this case, you can safely ignore the error.

Note: Wireshark 1.2 and above disable IP, TCP, and UDP checksum validation by default.

You can disable TCP checksum verification on Wireshark, so that it does not report any errors.

To disable TCP checksum verification on Wireshark:

1. Click Preferences > Edit. The Preferences dialog opens.
2. Click Protocols > TCP in the left pane.
3. Deselect Check the validity of the TCP checksum when possible.
4. Click Apply.
5. Click OK.

Alternatively, start Wireshark from the Windows command line and ensure that checksum offload validation is disabled from the launch of the application:

1. Click Start, type cmd, and click OK.
   
   
2. Run the command:
   
   cd "C:\Program Files\Wireshark\Wireshark.exe"
   
   
3. From within the Wireshark directory, type:
   
   wireshark.exe -o tcp.check_checksum:false

For more information about Wireshark checksum validation, see http://wiki.wireshark.org/CaptureSetup/Offloading.