[Bro] Huge number of "Bad_IP_Checksum" warnings on FreeBSD8 captured traffic.

Seth Hall hall.692 at osu.edu
Mon Apr 19 07:57:37 PDT 2010

On Apr 17, 2010, at 4:11 PM, Luca Renaud wrote:

> I have not counted but nearly every packet captured through tcpdump  
> on FreeBSD 8 i386 when analyzed by Bro
> generates a "Bad IP Checksum" weird warning.

Is your interface doing TCP offloading?  Try running Bro with the "-C"  


Seth Hall
Network Security - Office of the CIO
The Ohio State University
Phone: 614-292-9721

More information about the Bro mailing list