Wireshark-users: Re: [Wireshark-users] Checksum Display Filters
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Stephen Fisher <stephentfisher@xxxxxxxxx>
Date: Sun, 11 Feb 2007 13:35:22 -0800
On Sun, Feb 11, 2007 at 08:20:00PM -0000, Keith French wrote:

> Is there any difference from a logical point of view when using a 
> display filter to find packets with bad IP checksums between these two 
> expressions:-
> 
> ip.checksum_bad == 1
> or
> ip.checksum_good == 0
> 
> As a checksum can only be correct or bad, surely both of these filters 
> are the same?

Yes, those would both give the same results.


Steve