Wireshark · Ethereal-users: [Ethereal-users] Invalid ICMP Checksum

[Scott Fringer <fringsm@xxxxxxxxxxxxxxxxx>]

Hello,
  A colleague and I are working through a capture file with fragmented
ICMP packets.  In every one of these, only the initial part of the ICMP
echo request or echo reply is decoded as ICMP (the remaining fragments
are decoded as IP).    

  In the initial fragment of the ICMP packet, the ICMP checksum is not
listed as "correct" (as it is in single frame ICMP packets).  So we are
deducing that the ICMP checksum is incorrect.  Is this related to the
fact that the ICMP packet is composed of multiple fragments (and hence
the checksum can not be successfully computed)? Is there a way to stitch
all of the ICMP fragments together to verify the ICMP checksum is valid?

Thanks,

Scott

-- 
Scott Fringer                              Shands Healthcare @ U.F.
Technical Analyst II                       Gainesville, FL