Wireshark-users: Re: [Wireshark-users] How to compute the number of packets with bad checksum
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Chris Maynard <Chris.Maynard@xxxxxxxxx>
Date: Sun, 4 Dec 2011 17:58:09 +0000 (UTC)
W T <wokelmal@...> writes:

> Now, I need to calculate the number of IP packets that have IP header
> error (bad check sum)errors, using wireshark. Can any tell me the
> steps to do this.

How about just using a display filter of "ip.checksum_bad==1"?  The number of
packets matching the filter will be displayed and the count of them is indicated
in the status bar.  Alternatively, tshark could be used instead, e.g.,

tshark -r file.pcap -R "ip.checksum_bad == 1" | wc -l