Friday, May 22, 2009

Wireshark Strangeness

Playing around with Wireshark, looking at the dissected data, and getting some weird results. Evidently the small echo server I wrote (see below) does not create the correct TCP checksum. I thought that this might be an issue when using lo0 (loopback), but the data simply doesn't show up in Wireshark when going to/from the same IP address (in my case, 172.16.0.10). Shows up in netstat:

tcp4       0      0  172.16.0.10.46002      172.16.0.10.55074      ESTABLISHED
tcp4 0 0 172.16.0.10.55074 172.16.0.10.46002 ESTABLISHED
tcp4 0 0 *.46002 *.* LISTEN

Not sure what its issue is.

Loopback pcap file available here.


Read more...

No comments:

Post a Comment

Followers