TCP checksum offload
Sometimes outgoing TCP packets appear black with red Text and the TCP Checksum is marked as incorrect with the note [incorrect, should be xxxx (maybe caused by "TCP checksum offload"?)].
This is the case when your network adapter has the option called (TCP) Checksum Offload or similar, like newer Gigabit ethernet cards. When this option is enabled, the network adapter will calculate the checksum by itself, making the CPU not have to do this work. As Wireshark captures the packets before they get to the network adapter it won't see the correct checksum because it has not been calculated yet.
You can disable the option "Check the validity of the TCP checksum when possible" in the TCP dissector preferences if desired, so Wireshark won't check that any more.
If you are experiencing network problems and while trying to figure it out with Wireshark you found these checksum errors, you may have a network card with TCP checksum offload enabled and for some reason the packet is not being fixed by the adapter (NAT, bridge or route redirection is sending the packet to another interface). In this case, you may want to check and disable checksum offload for the adapter, if possible. On Linux, this is done with the ethtool command.
To check:
ethtool --show-offload ethX
To disable:
ethtool --offload ethX rx off tx off
Or, with some 3Com cards (see 3c59x vortex docs):
rmmod 3c59x ; modprobe 3c59x hw_checksums=0
See also
Checksums in Wireshark guide
