Ethereal-users: [Ethereal-users] Invalid ICMP Checksum

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Scott Fringer <fringsm@xxxxxxxxxxxxxxxxx>
Date: Mon, 25 Jul 2005 13:33:09 -0400
Hello,
  A colleague and I are working through a capture file with fragmented
ICMP packets.  In every one of these, only the initial part of the ICMP
echo request or echo reply is decoded as ICMP (the remaining fragments
are decoded as IP).    

  In the initial fragment of the ICMP packet, the ICMP checksum is not
listed as "correct" (as it is in single frame ICMP packets).  So we are
deducing that the ICMP checksum is incorrect.  Is this related to the
fact that the ICMP packet is composed of multiple fragments (and hence
the checksum can not be successfully computed)? Is there a way to stitch
all of the ICMP fragments together to verify the ICMP checksum is valid?

Thanks,

Scott

-- 
Scott Fringer                              Shands Healthcare @ U.F.
Technical Analyst II                       Gainesville, FL