Wireshark · Wireshark-users: Re: [Wireshark-users] Checksum Display Filters

[Stephen Fisher <stephentfisher@xxxxxxxxx>]

On Sun, Feb 11, 2007 at 08:20:00PM -0000, Keith French wrote:

> Is there any difference from a logical point of view when using a 
> display filter to find packets with bad IP checksums between these two 
> expressions:-
> 
> ip.checksum_bad == 1
> or
> ip.checksum_good == 0
> 
> As a checksum can only be correct or bad, surely both of these filters 
> are the same?

Yes, those would both give the same results.


Steve