When TCP checksum offloading is enabled, the checksum for packets that originate on the appliance is calculated by the network interface rather than by the CPU. Because the tcpdump utility grabs the packet before it is sent to the network interface, and before the checksum has been calculated, the checksum field has "junk" data. This action causes packet capture programs like Wireshark to report a bad checksum even though the packet on the wire has the correct checksum value.

NOTE: This feature only affects the checksums for packets that originate from the system in which the tcpdump is taken. Packets sent by other systems are not affected.