Ask Your Question

No response to field -e "ip.checksum_calculated"

asked 2021-09-20 07:23:47 +0000

sandippatel gravatar image
  1. Not getting any response while using tshark on linux with following command for "ip.checksum_calculated"
  2. What will be possible values of "-e ip.checksum.status", and their meaning, as of now getting 2 as response

Command: tshark -P -T fields -E header=n -E separator=\| -E occurrence=f -e frame.time_epoch -e frame.number -e frame.len -e frame.protocols -e ip.checksum -e ip.checksum_calculated -e ip.checksum.status

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2021-09-20 08:50:56 +0000

grahamb gravatar image

The checksum is only calculated if the preference ip.check_checksum is true, in the GUI this is set by the IP protocol preference "Validate the IPv4 checksum if possible".

If you add -o ip.check_checksum:true (that's the lower-case letter o, not zero) to your command line the preference will be set for that run of tshark.

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2021-09-20 07:23:47 +0000

Seen: 124 times

Last updated: Sep 20 '21