# http\_request event

**URL:** <https://community.zeek.org/t/http-request-event/783>\
**Category:** Zeek\
**Created:** [June 20, 2005, 3:29am UTC](https://community.zeek.org/t/http-request-event/783 "2005-06-20T03:29:27Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vern](https://yyz1.discourse-cdn.com/flex011/user_avatar/community.zeek.org/vern/32/630_2.png) [@Vern](https://community.zeek.org/u/Vern)\
**Post date:** [June 20, 2005, 3:29am UTC](https://community.zeek.org/t/http-request-event/783/1 "2005-06-20T03:29:27Z")

</div>

> &nbsp;&nbsp;&nbsp;You are right. The machine where Bro is running generated BAD\_TCP\_Checksum  
> packets. This is why I didn't see any tcp traffic sent by this machine. Do you  
> think which part causes this checksum problem: IC card or system driver?

When we've seen this before, it was because the NIC offloading checksumming,  
so packets capture by the packet filter didn't have their checksums filled in.  
This was revealed via ifconfig, along the lines of:

&nbsp;&nbsp;&nbsp;&nbsp;1 % ifconfig em0  
&nbsp;&nbsp;&nbsp;&nbsp;em0: flags=8843\<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST\> mtu 1500  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;options=3\<RXCSUM,TXCSUM\>  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;inet 131.243.X.Y netmask 0xffffff00 broadcast 131.243.X.255  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;ether 00:01:02:03:04:05  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;media: Ethernet autoselect (1000baseTX \<full-duplex\>)  
&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;status: active

If so, trying running bro with -C (ignore checksums).

&nbsp;&nbsp;&nbsp;&nbsp;Vern

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/http-request-event/783/2 "2022-05-06T15:37:31Z")

</div>


