CODEWITHSUNDEEP
wireshark
user2214609
user2214609

Reputation: 4951

Check whether Wireshark file contain bad checksum packets

I am looking for command via command line that tell me whether Wireshark file contain bad checksum packets, not using the GUI but using the command line (maybe via Tshark ?)

i have seen this command here in this forum but cannot find it now.

Upvotes: 2

Views: 5075

Answers (2)

Achute Sharma
Achute Sharma

Reputation: 21

You can use: _ws.expert.group == "Checksum" as the filter, which checks for bad checksum errors.

tshark -r input.pcap -Y '_ws.expert.group == "Checksum"'

Upvotes: 2

graphite
graphite

Reputation: 2958

You can filter packets that has specific field:value with tshark. For TCP packets there is tcp.checksum_bad field. There can be another field for other protocols. Also fot TCP dissector there is option that enable/disable checksum validation tcp.check_checksum. So to find packet with bad checksum with tshark:

tshark -o 'tcp.check_checksum:True' -Y 'tcp.checksum_bad==True' -r input.pcap

Also you can try expert.message=="Bad checksum" filter.

Upvotes: 3

Related Questions