- more work on the tcp checksum... realisation that wireshark has to usethe ip addresses from the ip header... doh.