I have a packet trace that I forge with scapy
and resend with tcpreplay
. I recompute IP and transport-layer checksums with Scapy
, save the packets to disk on pcap
file and call tcpreplay
on it.
By running tcpdump
in parallel I noticed that all IP checksums of those outgoing packets have no value at all. It seems that tcpreplay
is removing it each time.
Now, does this happen on purpose? Am I missing something?
Checksums should be correct, so I don't think tcpreplay
removes them because a check on it failed.
You didn't specify the actual tcpreplay command you are using, but tcpreplay never edits packets. You can use tcpreplay-edit or tcprewrite to edit packets, but not tcpreplay. And even then tcpreplay-edit/tcprewrite will calculate/fix your checksums; not zero them out.
Have you opened up the original pcap generated by scapy in Wireshark and verified there are actually checksums there? Honestly, this sounds like a simple case of garbage in, garbage out.
FWIW, I'm not aware of anything that would zero out your checksums... at least I can't imagine why the kernel would do that for packets sent via the PF_PACKET interface- that would be a bug IMHO.
If you figure it out, let me know.