We're now a non-profit! Support open source packet analysis by making a donation.

Wireshark-users: Re: [Wireshark-users] Checksum Display Filters

From: Stephen Fisher <stephentfisher@xxxxxxxxx>
Date: Sun, 11 Feb 2007 13:35:22 -0800
On Sun, Feb 11, 2007 at 08:20:00PM -0000, Keith French wrote:

> Is there any difference from a logical point of view when using a 
> display filter to find packets with bad IP checksums between these two 
> expressions:-
> ip.checksum_bad == 1
> or
> ip.checksum_good == 0
> As a checksum can only be correct or bad, surely both of these filters 
> are the same?

Yes, those would both give the same results.