0

I sniffing udp communication with 2 instance of wireshark , 1: 2.0.0 2: 2.2.1 .

In version 2.0.0 I get valid udp.checksum , but with 2.2.1 I always get udp checksum = 0000 .

Why is that? those wireshark sniffing the same packets.

The real problem is , when I save the same packet and play this packet via 'playcap' or another tools that only play pcap file , so if I saved it with in wireshark 2.0.0 I get a response from the pc , but if I saved it via 2.2.1 I not get a response from the pc.

That same packet data , but it seem that wireshak damadge it , is that make sense?

  • For IPv4 the UDP checksum is optional. – Ron Maupin Nov 12 '18 at 15:22
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 25 '18 at 10:01
2

Can you see if the UDP checksum is 0 in the packets?

If so, it means "no checksum sent", which is valid for UDP on IPv4.

Wireshark might care to display "it's zero" differently from "sent and calculated as valid", and might well do so differently from one version to another.

  • see my edit , that same packet the I see in 2 diffrent wireshark versions – pointers Nov 12 '18 at 15:31
  • Wireshark is an unusually well-tested piece of software, so it's very unlikely that Wireshark damaged the packet. Can you put the capture up so we can see? – jonathanjo Nov 12 '18 at 15:54
  • I sniffer not ping from my pc with 2 wireshark , I see that 2.0.0 record ping well but 2.2.1 put 0x000 in header checksum in Internet Protocol Versions – pointers Nov 12 '18 at 15:57
  • It would really help if you show us what you're saying looks wrong. – jonathanjo Nov 12 '18 at 16:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.