This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

ICMP Checksum.

0

Hi all,

I need your help, I'm trying to calculate checksum on icmp packet type 8 ( Ping ) but I can't obtain checksum value, how i can do it? what is the value of data field?

I have this values, you can check the print, I hope you can help me.

type 8--8_bits; codigo 0--8_bits; id_be 1 --- 16 bits; id_le 256 --16bits; Se_be 4104---16 bits; Se_le 2064 16 bits data ?????
checksum is 0x3d53

0000

0001
0256
2064
4104
2064
---> data value????? then complement 1.

alt text

asked 16 May '12, 12:18

blackfredy's gravatar image

blackfredy
0225
accept rate: 0%


One Answer:

5

From RFC 792:

Checksum

The checksum is the 16-bit ones's complement of the one's complement sum of the ICMP message starting with the ICMP Type. For computing the checksum , the checksum field should be zero. If the total length is odd, the received data is padded with one octet of zeros for computing the checksum. This checksum may be replaced in the future.

So you have to split the ICMP header + payload (data) into 16 bit words (using 0x0000 for the checksum field) like this:

0x0800
0x0000
0x0001
0x1008
0x6162
0x6364
0x6566
0x6768
0x696a
0x6b6c
0x6d6e
0x6f70
0x7172
0x7374
0x7576
0x7761
0x6263
0x6465
0x6667
0x6869

Then calculate the one’s complement sum of the first two words and then repeatedly calculate the one’s complement sum of the result and the next 16 bit word until you reach 0x6869. At last, calculate the one’s complement by inverting all bits.

(Also have a look at RFC 1071: Computing the Internet Checksum)

answered 16 May ‘12, 13:34

SYN-bit's gravatar image

SYN-bit ♦♦
17.1k957245
accept rate: 20%

Hey!!!

You go it!!! i calculate and the result is 49836, i do the complement ( 65535-49836 = 15699 ) and get the answer!!!!, I have to calculate using more types on icmp, if a need help a will write again.

Thanks thanks in advance!!!

Bye.

(16 May ‘12, 14:56) blackfredy

(I converted your “answer” to a “comment”, as that’s the way this site works best, please see the FAQ)

(16 May ‘12, 14:59) SYN-bit ♦♦