Ethereal-users: Re: [Ethereal-users] confusion about TCP checksum calculation

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Hamish Moffatt <hamish@xxxxxxxxxxxx>
Date: Tue, 1 Jan 2002 22:15:21 +1100
On Tue, Jan 01, 2002 at 10:08:02PM +1100, Hamish Moffatt wrote:
> 0000  00 40 95 e1 16 40 00 40  05 69 a2 40 08 00 45 00   .@...@.@ .i.@..E.
> 0010  05 dc 68 3f 40 00 e5 06  3f 06 c2 49 49 71 cb 0e   ..h?@... ?..IIq..
> 0020  12 0d 00 50 08 db f3 58  ca 5e 02 b6 08 57 80 10   ...P...X .^...W..
> 0030  fe 88 44 af 00 00 01 01  08 0a 07 79 a6 a0 00 06   ..D..... ...y....
> 0040  55 32 0e 0a 30 07 1f a0  8c a5 c0 9a 43 fd a6 89   U2..0... ....C...
> 0050  d0 07 65 30 04 37 50 0c  32 f0 01 1a 80 2f e8 37   ..e0.7P. 2..../.7
> 

[...]

> Ethereal (0.9.0) says this second frame has an incorrect TCP checksum.
> I can't figure out why changing the link layer headers causes the
> TCP checksum to change? Or is there a bug in the calculation
> somewhere?

Stranger yet; I fed the exact same packet as captured back in
(text2pcap with no -l option) and got the same checksum error
in the decode.

Hamish
-- 
Hamish Moffatt VK3SB <hamish@xxxxxxxxxx> <hamish@xxxxxxxxxxxx>