Network & Infrastructure / Linux Networking & Host Performance
Checksum and segmentation offloads in misleading packet captures
A host capture displays giant TCP packets or invalid checksums, while the remote peer receives valid traffic. NIC offload can change what is visible before packets reach the wire.
Environment and inputs: Linux network namespaces, host routing and network drivers; availability and semantics depend on kernel and driver versions. Diagnostic/design example; not tested on production equipment.
Collect the evidence
Record capture location, checksum/segmentation offloads and a comparison capture beyond the NIC where available. Check capture drops before inferring actual network packet corruption.
Explain the result
The host can capture packets before hardware completes checksum calculation or segmentation. Those observations may describe an intermediate representation rather than the exact frames transmitted.
Plan the fix
Interpret captures with offload context and use a suitable independent observation point. Disable an offload only for a controlled diagnostic need and account for the resulting CPU and performance change.
Check the result and rollback
Confirm whether the suspected defect exists on the wire or only in the host capture. Restore normal offloads after the investigation if disabling them adds load without fixing a real delivery problem.