Wireshark · Wireshark-users: [Wireshark-users] Checksum Display Filters

["Keith French" <keithfrench@xxxxxxxxxxxxx>]

In the IP, TCP or UDP headers is the "Checksum" field, which has two parts to it. For the IP checksum this is:-

 

Header checksum: 0xbbd5 [correct]
        [Good: True]
        [Bad : False]

 

with similar for the TCP and UDP checksums.

 

Is there any difference from a logical point of view when using a display filter to find packets with bad IP checksums between these two expressions:-

 

ip.checksum_bad == 1

 

or

 

ip.checksum_good == 0

 

As a checksum can only be correct or bad, surely both of these filters are the same?