Disable checksum verification for Linux cooked-mode capture (SLL) traces
Author: 0xxonCreated Apr 14, 2026Updated Sep 9, 2026
LabelsArea: Packet Capture
tcpdump will create traces without native link headers in some cases - like when capturing from "any".
Apparently, the IP checksum is always set to all-zero for these kinds of captures. It seems like it would make sense to support parsing such pcaps out of the box, without emitting any errors.
Source: zeek/zeek