Bad Checksum in a VPN Capture Is Not File Corruption

The analyzer marks a packet as having a bad checksum, and a downloaded file looks wrong, so the two observations get joined into one story about corruption on the VPN. They are different measurements taken at different points. One describes what the capture mechanism saw before the network adapter finished its work; the other describes bytes the application stored. Establishing which one actually changed is the entire diagnosis.

Where the capture sits relative to the adapter

A packet capture is a snapshot at one point in a path that contains several transformations. Between the host stack and the wire sit segmentation, checksum calculation and, on receive, coalescing. A capture point shows the state at that instant, which is rarely identical to the final wire frame. Reading it as though it were the wire is how a placeholder field turns into an accusation.

So the useful question about any suspicious field is not whether it looks wrong but where it was observed. Write the capture interface, the analyzer version and the packet layer next to the finding; without those three, a checksum label cannot be interpreted at all.

What transmit offload does to a trace

With transmit checksum offload enabled, the adapter computes the checksum and fills the field after the host has queued the packet. A host-side capture therefore records a placeholder, and the analyzer reports a checksum that the wire never carried. Segmentation offload creates a similar artifact, because the host can hand the adapter one large buffer that becomes several frames later.

Wireshark's offloading reference describes both effects and notes that recognising partial checksums depends on the analyzer version and packet type. That is why an older capture tool and a newer one can disagree about the same trace while both are reading it correctly.

Encapsulation adds a second object

A VPN inserts a second packet into the picture. The tunnel interface shows the inner packet that the application really sent, while the physical interface shows the outer encapsulated connection that carries it. A checksum or length taken from the inner packet does not belong to the outer frame, and comparing the two as if they described the same object produces nonsense.

When you need to compare, compare like with like: inner with inner, outer with outer, at the same point in the path. A mismatched pair of fields proves only that two different objects were measured. Note which interface each trace came from, because a tunnel capture that looks clean says nothing about what the adapter emitted.

Prove file integrity with hashes

For the file itself, compute a content hash of a reproducible source and of the stored result, and compare the digests. That answers a different question from any per-packet label, and it answers it about the object the user actually cares about.

sha256sum payload.bin
sha256sum /srv/transfer/payload.bin
cmp -l payload.bin /srv/transfer/payload.bin | head

Equal digests close the corruption question for that transfer. Different digests open a narrower one: find the earliest stage where the bytes diverge, and check whether something transformed the file on purpose. A partial save, a re-encoded attachment and an error page stored under the expected filename all change bytes without any network defect.

Localise an adapter path without making it permanent

For a reproducible problem that follows one dock or adapter, hold the VPN profile, application, test object and destination fixed, then repeat the transfer through a supported alternate interface. A result that changes with the adapter localises the fault to that path; it does not yet identify a driver setting or prove a model-wide defect.

Disabling offload globally is a tempting test and a bad default. A host-wide setting affects traffic far beyond the experiment and can carry a real performance cost, so treat any such change as temporary, record it, and revert it. Use the vendor's supported diagnostics before you keep a workaround that was borrowed from a different machine.

The report should state which of the three results changed: the analyzer's interpretation of a packet, the completed application bytes, or the reproducibility of one adapter path. Those lead to three different next actions, and only one of them is about encryption.