Good morning!
I’m curious as to whether or not an invalid checksum as a result of offloading would prevent the tcp_SYN_packet event from firing…? I took a cursory look but thought it might be faster to just ask. 
Thanks!
If you mean “connection_SYN_packet”, the default behavior is to not generate that event for packets w/ invalid checksums.
- Jon
Oops! Sorry, yes. Thanks!
I notice that you say “default behavior”. Is there an enum or constant that I can adjust to change this behavior?
Not specifically for this event, but you can generally ignore checksum errors via “redef ignore_checksums=T;” or using the -C command line option.
- Jon
Thanks!