I'm writing a script where I need tshark to calculate the frame check sequence. I know I can output the existing FCS that is stored in the packet with:
But if this FCS is wrong, can tshark calculate the correct one? In wireshark if I open a file where the FCS is wrong, wireshark tells me it's wrong and outputs the value that it should be. Can tshark output the value that it should be instead of just what is stored in the packet data?
asked 31 Jul '13, 15:38
Here is how you can view the calculated FCS with tshark:
I leave it as an exercise for the reader to extract the FCS from the output :-)
answered 01 Aug '13, 14:15