consequences in pf


old way: update cksum. new way: recalculate cksum.

updating a broken cksum gives a broken cksum

replacing a broken cksum with a recalculated one... OUPS!

need to check the existing cksum before modifying the packet
potentially expensive if there is no offloading
payload not in cache for forwarded packets