Wireshark · Wireshark-users: [Wireshark-users] Capturing only packets with bad TCP Checksum

[Martin Isaksson <martin.isaksson@xxxxxxxxxxxx>]

Hi,

 

Is there any way of creating a capturing filter to only get packets that have a bad TCP checksum?

Or am I better off creating a circular buffer of files and postprocessing with display filters them to save only the bad segments (and then merge with mergecap at the end)?

 

Thanks,

Martin