#5343·zeek

Disable checksum verification for Linux cooked-mode capture (SLL) traces

Author: 0xxonCreated Apr 14, 2026Updated Sep 9, 2026
LabelsArea: Packet Capture

tcpdump will create traces without native link headers in some cases - like when capturing from "any".

Apparently, the IP checksum is always set to all-zero for these kinds of captures. It seems like it would make sense to support parsing such pcaps out of the box, without emitting any errors.