Virtual ethernet devices, which are used in some container deployments (you &#x2F; your ops team probably know if you&#x27;re using them), do not check TCP checksums. This appears to be because the original programmer was thinking about applications on the <i>same machine</i> communicating across virtual ethernet devices, but the optimization also affected traffic from a physical network that was routed onto a virtual network.<p>If your physical network corrupts data, TCP is supposed to notice the checksum mismatch and drop the packet, and wait for it to be retransmitted. Because of this bug, Linux&#x27;s TCP implementation was not validating checksums, which allowed corrupt data to reach the application.<p>This requires a faulty physical network, which is rare but nowhere near nonexistent. (The kernel is not <i>introducing</i> corruption to these packets.)