0

I sniffing udp communication with 2 instance of wireshark , 1: 2.0.0 2: 2.2.1 .

In version 2.0.0 I get valid udp.checksum , but with 2.2.1 I always get udp checksum = 0000 .

Why is that? those wireshark sniffing the same packets.

The real problem is , when I save the same packet and play this packet via 'playcap' or another tools that only play pcap file , so if I saved it with in wireshark 2.0.0 I get a response from the pc , but if I saved it via 2.2.1 I not get a response from the pc.

That same packet data , but it seem that wireshak damadge it , is that make sense?

Improve this question
2
  • For IPv4 the UDP checksum is optional.
    – Ron Maupin ♦
    Commented Nov 12, 2018 at 15:22
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Commented Dec 25, 2018 at 10:01

1 Answer 1

Reset to default
2

Can you see if the UDP checksum is 0 in the packets?

If so, it means "no checksum sent", which is valid for UDP on IPv4.

Wireshark might care to display "it's zero" differently from "sent and calculated as valid", and might well do so differently from one version to another.

Improve this answer
4
  • see my edit , that same packet the I see in 2 diffrent wireshark versions
    – pointers
    Commented Nov 12, 2018 at 15:31
  • Wireshark is an unusually well-tested piece of software, so it's very unlikely that Wireshark damaged the packet. Can you put the capture up so we can see?
    – jonathanjo
    Commented Nov 12, 2018 at 15:54
  • I sniffer not ping from my pc with 2 wireshark , I see that 2.0.0 record ping well but 2.2.1 put 0x000 in header checksum in Internet Protocol Versions
    – pointers
    Commented Nov 12, 2018 at 15:57
  • It would really help if you show us what you're saying looks wrong.
    – jonathanjo
    Commented Nov 12, 2018 at 16:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.