This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hello,

I have an issue in the network. Files are getting sometimes corrupted while being copied using SMB over WAN link. I did a packet capture on both ends and now need a tool to compare packets/segments payload/body/data to find which exact packet is being corrupted/changed.

Is there any tool which will allow to compare the payloads of sent and received packets? Checking checksums on the receiver is not welcomed because I think the packets are being corrupted in the network and their checksums are being calculated after that. Thanks.

Handshake.

asked 13 Oct '16, 12:26

handshake's gravatar image

handshake
6112
accept rate: 0%


I'm sure better tools exist, but you may use tshark with an appropriate filter to dump just the tcp.seq and tcp.checksum of the necessary direction of the SMB session in question from both captures to text files and then use diff to compare the text files. The TCP checksum of the corrupt packet as it has arrived to the destination will probably be correct but it will be different from the one at the source.

tshark -r <file_name> -Y "tcp.stream == n and ip.dst == m.m.m.m" -T fields -e tcp.seq -e tcp.checksum

This assumes that no packets have been lost and retransmitted, though. If they have, you would have to use sort -u before running the diff.

permanent link

answered 13 Oct '16, 12:45

sindy's gravatar image

sindy
6.0k4851
accept rate: 24%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×5

question asked: 13 Oct '16, 12:26

question was seen: 544 times

last updated: 13 Oct '16, 12:45

p​o​w​e​r​e​d by O​S​Q​A