Send TCP with incorrect checksums

Question

I'm having trouble sending large files to an OpenStack machine.

Our Internet connection is over LTE so bad packets are to be expected. However, even sending data over TCP results in corrupted data when sending a few MB.

I would like to test if the TCP checksums are really being verified, so I need a tool to send TCP packets with invalid checksums.

There are programs which allow me to send arbitrary IP packets, but I would prefer a tool which also starts the connection (performs the three-way handshake, etc.) for me.

I can then use tcpdump to check if the server ACKs the packets or requests a resend. (If the tool could do this as well, even better.)

Some thoughs and notes:

• I have tried different Linux versions on both the client and server.
• We no longer have corrupt packets when switching to a (slower) DSL line.
• We do not have corrupt packets when sending to another server from a different host.
• I have tcpdumps of a TCP transmission from both the client and server but the OpenStack host doesn't want to look at them, which is why I would like to find out if the checksums are the problem and also have a test program for the host.
• The server is an instance in an OpenStack environment.
• The recent veth TCP checksum corruption bug in the Linux kernel would explain this bug.

Any other ideas how to debug this are also welcome.

Answer 1

https://github.com/kubernetes/kubernetes/issues/18898

explains how to do this.

Here a (shortened) version:

On the receiving machine run nc -l -p 12345

On the sending machine run (i=0; while true; do echo aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa $i; i=$((i+1)); sleep 1; done) | netcat IP_OF_RECEIVING_MACHINE 12345

To corrupt the packages execute the following command on the sender machine:

sudo tc qdisc add dev eth0 root netem corrupt 100%; sleep 10; sudo tc qdisc del dev eth0 root netem

Note that during 10 seconds all packages on eth0 will be corrupted!

If checksumming works correctly you won't receive any text during the 10 seconds and then receive them at once. If however checksumming doesn't work you will get corrupted text.

Answer 2

python3 scapy crafts packets with TCP Checksum syntax:

>>>p=IP/TCP(dport=22, chksum=0xffff)
>>>send(p)

Above will send a SYN packet to scapy's current default destination IP address, from scapy's current default source IP address, to a destination port 22, from scapy's current default source port, using what will most likely be an invalid TCP Checksum 0xffff.

Answer 3

• You can use a packet crafting tool such as hping, hping3. Check the link down below, it's very useful;

  hping3 examples

  From the link above, I think this is what you are searching for;

  -b --badcksum (try to) send packets with a bad IP checksum many systems will fix the IP checksum sending the packet so you'll get bad UDP/TCP checksum instead.

• If you have programming skills (socket programming, BSD sockets on linux, you can google them), you can send dummy tcp packets using raw sockets, build up your own Transport Layer packet.