We're now a non-profit! Support open source packet analysis by making a donation.

Wireshark-users: Re: [Wireshark-users] Checksum Display Filters

From: Jaap Keuter <[email protected]>
Date: Sun, 11 Feb 2007 22:32:10 +0100 (CET)

Not for UDP, there the checksum can be omitted.


On Sun, 11 Feb 2007, Keith French wrote:

> In the IP, TCP or UDP headers is the "Checksum" field, which has two parts to it. For the IP checksum this is:-
> Header checksum: 0xbbd5 [correct]
>         [Good: True]
>         [Bad : False]
> with similar for the TCP and UDP checksums.
> Is there any difference from a logical point of view when using a display filter to find packets with bad IP checksums between these two expressions:-
> ip.checksum_bad == 1
> or
> ip.checksum_good == 0
> As a checksum can only be correct or bad, surely both of these filters are the same?