No response to field -e "ip.checksum_calculated"

ip.checksum

asked 2021-09-20 07:23:47 +0000

Not getting any response while using tshark on linux with following command for "ip.checksum_calculated"
What will be possible values of "-e ip.checksum.status", and their meaning, as of now getting 2 as response

Command: tshark -P -T fields -E header=n -E separator=\| -E occurrence=f -e frame.time_epoch -e frame.number -e frame.len -e frame.protocols -e ip.checksum -e ip.checksum_calculated -e ip.checksum.status

edit retag flag offensive close merge delete

add a comment

1 Answer

Sort by » oldest newest most voted

answered 2021-09-20 08:50:56 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23790 ●4 ●950 ●227 https://www.wireshark.org

The checksum is only calculated if the preference ip.check_checksum is true, in the GUI this is set by the IP protocol preference "Validate the IPv4 checksum if possible".

If you add -o ip.check_checksum:true (that's the lower-case letter o, not zero) to your command line the preference will be set for that run of tshark.

edit flag offensive delete link

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2021-09-20 07:23:47 +0000

Seen: 159 times

Last updated: Sep 20 '21

Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.

No response to field -e "ip.checksum_calculated" edit

1 Answer