Investigating TCP Checksum Issues With Wireshark

Investigating TCP Checksum Issues With Wireshark
Protocol analysis is an ever changing art because of 2 significant variables:
Protocols
Every time an application gets an update it might affect the way it interacts with protocols.
Operating system upgrades may change the actual protocols or drivers.
Certain applications might come with its own ‘built in protocols’
Tools
Every protocol analyzer will have its own different GUI, protocol dissector or decoder and presentation
Even when you think you got the hang of the tool, that vendor may decide it’s time for an upgrade which may remove, add or break some significant features
In this example I will focus on Wireshark and TCP checksum issues.
Quick review a checksum is calculated and included by the sender of the data. The receiver performs the same math, using the same formula and should get the same checksum value. If this is not the case the receiver ‘may’ decide to discard that packet. I say may because the behavior is based entirely on the vendor and specific protocol in question.
When it comes to TCP I have seen scenarios where a bad .................................
read the free full article at
NetworkDataPedia Blog: www.networkdat...
when its posted