If the first packet has right checksum and the second one not, I'd assume you're calculating checksum for incorrect data block or you're not including the AH header.
I understand the IP checksum is correct. It would mean it's either AH or TCP header. Look into that fragment carefully, it's probably something very simple. Also, if you have a debugging console where you can print something, write checksums after calculating it for one header after another (depending on the function you use; which should in fact calculate it all correctly if you give it correct packet boundaries). It should show something.
|