Wireshark · Ethereal-dev: [ethereal-dev] new feature: calculate correct ip checksum

["Johannes Hennecke" <Johannes.Hennecke@xxxxxxx>]

Hello,

I have built a new feature for ethereal: If an IP frame with an incorrect
checksum is received by ethereal not only an "incorrect" is shown but
supplementary the correct ip checksum is calculated.
I use this feature to correct frames generated byte by byte with a test tool.
Ethereal receives this frame and calculates the correct checksum of the frame. I
 take the correct checksum and enter it the frame to send by the test tool. Now
the test tool is able to send an IP frame with an correct IP checksum.

The MS network monitor 2.0 (Windows 2000) has this feature built in.

Greetings

Johannes Hennecke
____________________________________________________________

 Johannes Hennecke  Broadband Communications
 ELSA AG       Engineering Consumer Communications
 Sonnenweg 11       Phone:  +49-(0)241-606-4779
 52070 Aachen       Fax: +49-(0)241-606-2099
 Germany       EMail:  johannes.hennecke@xxxxxxx
____________________________________________________________

--------- correct Frame --------------------------------
Ethernet II
Internet Protocol
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default)
    Total Length: 48
    Identification: 0xaf15
    Flags: 0x04
    Fragment offset: 0
    Time to live: 128
    Protocol: TCP (0x06)
    Header checksum: 0x04af (correct)
    Source: 34.1.1.1 (34.1.1.1)
    Destination: 35.1.1.1 (35.1.1.1)
Transmission Control Protocol, Src Port: 1298 (1298), Dst Port: http (80), Seq:
25698989, Ack: 0

--------- Frame with incorrect ip checksum -------------
Ethernet II
Internet Protocol
    Version: 4
    Header length: 20 bytes
    Differentiated Services Field: 0x00 (DSCP 0x00: Default)
    Total Length: 48
    Identification: 0xaf15
    Flags: 0x04
    Fragment offset: 0
    Time to live: 128
    Protocol: TCP (0x06)
------ new feature: calculating correct ip checksum
------ if ip checksum of frame is not correct
    Header checksum: 0x05af (incorrect, must be 0x04af)
-------------------------------------------------------
    Source: 34.1.1.1 (34.1.1.1)
    Destination: 35.1.1.1 (35.1.1.1)
Transmission Control Protocol, Src Port: 1298 (1298), Dst Port: http (80), Seq:
25698989, Ack: 0



changes made in packet-ip.c listed with "diff"
------------------------------------------------------------
diff -w -b packet-ip.c packet-ip-new.c
=====================================================================
779c779,781
< static char *ip_checksum_state(e_ip *iph)
---
> /* new feature: calculating correct ip checksum if ip checksum of frame is not
 correct */
>
> static int ip_checksum_state(e_ip *iph)
796c798,818
<         return "incorrect";
---
>         return(FALSE);
>
>     return(TRUE);
> }
>
> static unsigned short ip_checksum(e_ip *iph)
> {
>     unsigned long Sum;
>     unsigned char *Ptr, *PtrEnd;
>     guint16 ipsum;
>
>     Sum    = 0;
>     ipsum = iph->ip_sum;
>     iph->ip_sum = 0;
>     PtrEnd = (lo_nibble(iph->ip_v_hl) * 4 + (char *)iph);
>     for (Ptr = (unsigned char *) iph; Ptr < PtrEnd; Ptr += 2) {
>         Sum += pntohs(Ptr);
>     }
>     iph->ip_sum = ipsum;
>     Sum = (Sum & 0xFFFF) + (Sum >> 16);
>     Sum = (Sum & 0xFFFF) + (Sum >> 16);
798c820
<     return "correct";
---
>     return((unsigned short)~Sum);
800a823,824
> /* end of new feature */
>
879a904,910
>
>     /* new feature: calculating correct ip checksum if ip checksum of frame is
 not correct */
>
>     if(ip_checksum_state((e_ip*) &pd[offset]))
>         proto_tree_add_uint_format(ip_tree, hf_ip_checksum, NullTVB, offset +
10, 2, iph.ip_sum,
>             "Header checksum: 0x%04x (correct)", iph.ip_sum);
>     else
881c912,916
<         "Header checksum: 0x%04x (%s)", iph.ip_sum, ip_checksum_state((e_ip*)
&pd[offset]));
---
>             "Header checksum: 0x%04x (incorrect, must be 0x%04x)", iph.ip_sum,

>             ip_checksum((e_ip*) &pd[offset]));
>
>     /* end of new feature */
>
=====================================================================