ICMP PING checksum [correct]

Question

When looking at the ICMP (not IP) info from a PING conversation, what does the '[correct]' next to 'checksum' pertain to? It appears the checksum being displayed is with respect to the data being sent; if that's the case, how can the PING request say [correct] when it hasn't received anything?
What is being checked to generate the [correct], not just on the requesting side, but both?

Answer 1

[correct] means that Wireshark calculated the value that the checksum field in the ICMP header should have, according to RFC 792, and it's equal to the value it does have. That's all it means. (And, yes, I'm familiar with the Wireshark code; this is the log entry for the checkin that added the code to check the checksum:

------------------------------------------------------------------------ r2522 | guy | 2000-10-20 21:34:47 -0700 (Fri, 20 Oct 2000) | 3 lines

Check ICMP checksum. XXX - won't work if the ICMP packet is inside a fragmented IP datagram, although that's probably extremely unlikely.

Answer 2

That's the ICMP checksum as defined in RFC 792. The checksum calculation is defined for each type/code combination.

http://www.ietf.org/rfc/rfc792.txt

Cite: Checksum for echo request/response.

Checksum The checksum is the 16-bit ones's complement of the one's complement sum of the ICMP message starting with the ICMP Type. For computing the checksum , the checksum field should be zero. If the total length is odd, the received data is padded with one octet of zeros for computing the checksum. This checksum may be replaced in the future.

So, to answer your question. The [correct] means that Wireshark calculated the value itself and found that it's the same as the one in the ICMP packet.

Please also check the following question:

http://ask.wireshark.org/questions/11061/icmp-checksum

Regards
Kurt