Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Question about UDP checksum

From: "Helge Kruse" <Helge.Kruse-nospam@xxxxxxx>
Date: Fri, 05 Aug 2011 16:26:51 +0200
You've forgotten to include the UDP payload in your calculation. For the calculation the pseudo header must be in front of UDP header and UDP payload.

Helge

-------- Original-Nachricht --------
> Datum: Fri, 5 Aug 2011 15:45:38 +0200
> Von: "news.gmane.com" <AndreasSander1@xxxxxxx>
> An: wireshark-dev@xxxxxxxxxxxxx
> Betreff: [Wireshark-dev] Question about UDP checksum

> Hello,
> 
> I try to implement a UDP checksum routine. Unfortunately it calculates a 
> completely different value than Wireshark does. I don't known what I am 
> doing wrong. Can you help me?
> 
> The calculation is done using a UDP pseudo header with the structure
> 
> struct pseudo
> {
>     uint32 source;
>     uint32 destination;
>     uint8 zero;
>     uint8 protocol;
>     uint16 udp_length;
> };
> 
> When I have a UDP frame with IP source = "192.168.100.132" and IP 
> destination = "192.168.144.255", and UDP Length = 66 (IP Total_Length =
> 86) 
> I get this data in the pseudo header:
> 
>  c0 a8 64 84
>  c0 a8 90 ff
>  00 11 00 42
> 
> The sum is 0x32874 which is must be folded to 0x2874+0x0003 = 0x8277. The 
> complement is 0xd788.
> 
> But Wireshark detects an error and says the checksum must be 0x5528. Can 
> anybody give me a hint what's wrong?
> 
-- 
NEU: FreePhone - 0ct/min Handyspartarif mit Geld-zurück-Garantie!		
Jetzt informieren: http://www.gmx.net/de/go/freephone