Ethereal-users: Re: [Ethereal-users] ip.checksum filtering

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Tue, 20 Feb 2001 22:30:17 -0800 (PST)
> I scanned the docs, and google'd for it ...
> Is there a way to filter ip.checksum to only show packets
> that have incorrect checksums?

No - a filter expression that checks "ip.checksum" could only compare it
against a constant, which won't find invalid checksums.  Currently, the
best you could do would be to print the capture to a file (print the
detail, not the summary), pull the editor into a file and look for
packets with an incorrect checksum (search for "incorrect") or cook up a
script that scans through the file, remembers the frame number of the
current frame, and lists that frame number if it sees a line showing an
incorrect checksum).

Adding a hidden Boolean field "ip.bad_checksum" (and similar fields for
other protocols with checksums) might be useful.