Project

General

Profile

Actions
Copy link

Bug #1849

closed
AA JI

ICMPv6 incorrect checksum alert if Ethernet FCS is present

Bug #1849: ICMPv6 incorrect checksum alert if Ethernet FCS is present

Added by ajaxtpm ajaxtpm almost 10 years ago. Updated over 9 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Jason Ish
Target version:
3.1.2
Affected Versions:
Effort:
Difficulty:
Label:

Description

If there is a frame check sequence (FCS) field in Ethernet header (placed after all high-level payload) then ICMPv6 checksum calculates incorrectly and suricata alerts a lot of "Invalid ICMPv6 checksum" messages. If remove FCS field then checksum calculates correctly.
See pcap attached

Files

1.pcap (134 Bytes) 1.pcap ajaxtpm ajaxtpm, 07/21/2016 09:42 AM
Actions
Copy link

Also available in: PDF Atom