Ask Your Question
0

No response to field -e "ip.checksum_calculated"

asked 2021-09-20 07:23:47 +0000

sandippatel gravatar image
  1. Not getting any response while using tshark on linux with following command for "ip.checksum_calculated"
  2. What will be possible values of "-e ip.checksum.status", and their meaning, as of now getting 2 as response

Command: tshark -P -T fields -E header=n -E separator=\| -E occurrence=f -e frame.time_epoch -e frame.number -e frame.len -e frame.protocols -e ip.checksum -e ip.checksum_calculated -e ip.checksum.status

edit retag flag offensive close merge delete
add a comment

1 Answer

Sort by ยป oldest newest most voted
0

answered 2021-09-20 08:50:56 +0000

grahamb gravatar image

The checksum is only calculated if the preference ip.check_checksum is true, in the GUI this is set by the IP protocol preference "Validate the IPv4 checksum if possible".

If you add -o ip.check_checksum:true (that's the lower-case letter o, not zero) to your command line the preference will be set for that run of tshark.

edit flag offensive delete link more
add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

subscribe to rss feed

Stats

Asked: 2021-09-20 07:23:47 +0000

Seen: 211 times

Last updated: Sep 20 '21