diff --git a/scripts/base/misc/find-checksum-offloading.bro b/scripts/base/misc/find-checksum-offloading.bro index 15c1d6661d..d7e6577827 100644 --- a/scripts/base/misc/find-checksum-offloading.bro +++ b/scripts/base/misc/find-checksum-offloading.bro @@ -16,6 +16,7 @@ export { # Keep track of how many bad checksums have been seen. global bad_ip_checksums = 0; global bad_tcp_checksums = 0; +global bad_udp_checksums = 0; # Track to see if this script is done so that messages aren't created multiple times. global done = F; @@ -28,7 +29,11 @@ event ChecksumOffloading::check() local pkts_recvd = net_stats()$pkts_recvd; local bad_ip_checksum_pct = (pkts_recvd != 0) ? (bad_ip_checksums*1.0 / pkts_recvd*1.0) : 0; local bad_tcp_checksum_pct = (pkts_recvd != 0) ? (bad_tcp_checksums*1.0 / pkts_recvd*1.0) : 0; - if ( bad_ip_checksum_pct > 0.05 || bad_tcp_checksum_pct > 0.05 ) + local bad_udp_checksum_pct = (pkts_recvd != 0) ? (bad_udp_checksums*1.0 / pkts_recvd*1.0) : 0; + + if ( bad_ip_checksum_pct > 0.05 || + bad_tcp_checksum_pct > 0.05 || + bad_udp_checksum_pct > 0.05 ) { local packet_src = reading_traces() ? "trace file likely has" : "interface is likely receiving"; local bad_checksum_msg = (bad_ip_checksum_pct > 0.0) ? "IP" : ""; @@ -38,6 +43,13 @@ event ChecksumOffloading::check() bad_checksum_msg += " and "; bad_checksum_msg += "TCP"; } + if ( bad_udp_checksum_pct > 0.0 ) + { + if ( |bad_checksum_msg| > 0 ) + bad_checksum_msg += " and "; + bad_checksum_msg += "UDP"; + } + local message = fmt("Your %s invalid %s checksums, most likely from NIC checksum offloading.", packet_src, bad_checksum_msg); Reporter::warning(message); done = T; @@ -65,6 +77,8 @@ event conn_weird(name: string, c: connection, addl: string) { if ( name == "bad_TCP_checksum" ) ++bad_tcp_checksums; + else if ( name == "bad_UDP_checksum" ) + ++bad_udp_checksums; } event bro_done()