Ethereal-users: Re: [Ethereal-users] ip.checksum filtering

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "James E. Flemer" <jflemer@xxxxxxxxxxx>
Date: Wed, 21 Feb 2001 09:40:03 -0500 (EST)
On Tue, 20 Feb 2001, Guy Harris wrote:

> > I scanned the docs, and google'd for it ...
> > Is there a way to filter ip.checksum to only show packets
> > that have incorrect checksums?
> 
> No - a filter expression that checks "ip.checksum" could only compare it
> against a constant, which won't find invalid checksums.  Currently, the
> best you could do would be to print the capture to a file (print the
> detail, not the summary), pull the editor into a file and look for
> packets with an incorrect checksum (search for "incorrect") or cook up a
> script that scans through the file, remembers the frame number of the
> current frame, and lists that frame number if it sees a line showing an
> incorrect checksum).
> 
> Adding a hidden Boolean field "ip.bad_checksum" (and similar fields for
> other protocols with checksums) might be useful.
Yes I agree that would be nice. :-)
I have a few free hours this afternoon, I'll grab the
sources and see if I can hack this in. Of course I'm not
familiar with the sources (yet) so if someone beats me to
it let me know.
Thanks.
-James