I send TCP data between hosts (the topology is created using network namespaces and veth-pairs). For a host, I save its ingress and egress packets to pcap-file using NFLOG and tcpdump with the following commands executed at the host:
# we turn off checksum offload: sudo ethtool -K veth0 tx off sg off tso off ufo off # we log packets with nflog: sudo iptables -A OUTPUT -j NFLOG --nflog-group 17 sudo iptables -A INPUT -j NFLOG --nflog-group 17 # we write the packets: sudo tcpdump -i nflog:17 -w mypcap.pcap
So for all the outgoing TCP packets with zero Len the checksum is always wrong. This is true for all the hosts in the topology for egress traffic. For incoming traffic there is no such problem. This is because, as I checked (by regularly capturing with tcpdump over the host's interface rather than over NFLOG), when the egress traffic is leaving the host's interface the checksum is already corrected.
Pcap at sender (22.214.171.124), captured with NLOG:
Pcap at sender (126.96.36.199), captured regularly at sender's interface:
Pcap at receiver (188.8.131.52), captured with NLOG:
Pcap at receiver (184.108.40.206), captured regularly at receiver's interface:
So, as you can see in the images above, for pcaps captured from iptables NFLOG, for all the egress TCP pcakets which have Len equal to zero, TCP checksum is wrong. What can be the reason?
Thank you for attention!