So I got a frame where the port information is missing but I have everything else, how can I retrieve the port that where used in the frame ?

I was thinking about the tcp checksum, but is it reversible ?

The frame is just a TCP header encapsulated in a IP frame.

P.S:This is part of a "hack" challenge, this is why the situation is weird.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Feb 19 '18 at 19:05

You can't reconstruct missing packet elements from the checksum. It's for error detection, not correction.

If just one byte/word/longword is missing it could be reconstructed, e.g. by just trying all possible values and recalculating the checksum. However, educational purposes, hacking challenges and such are off-topic here.


The TCP checksum is 16 bits and a port number is also 16 bits. So if just one port number is missing you have a reasonable chance of finding the port number by brute force but you may end up with more than one possible answer.

If both port numbers are missing then this isn't going to work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.