Why are some UDP packet checksums marked as unverified

asked 2024-02-06 22:14:28 +0000

sam.mink gravatar image

I set UDP checksums to be verified if possible. I see some packets with a checksum status of "Good" but other packets have their checksum status labeled as "unverified." What would cause the status of some checksums to be marked as unverified?

edit retag flag offensive close merge delete

Comments

Is the UDP encapsulated in another protocol?

Frame 25974: 74 bytes on wire (592 bits), 74 bytes captured (592 bits) on interface d880399dce6d_A, id 5
Ethernet II, Src: Cisco_6a:fe:f0 (00:15:62:6a:fe:f0), Dst: Cisco_79:3f:10 (00:1e:7a:79:3f:10)
Internet Protocol Version 4, Src: 193.24.225.56, Dst: 193.24.225.54
Internet Control Message Protocol
    Type: 3 (Destination unreachable)
    Code: 3 (Port unreachable)
    Checksum: 0xba60 [correct]
    [Checksum Status: Good]
    Unused: 00000000
    Internet Protocol Version 4, Src: 193.24.225.54, Dst: 193.24.225.56
    User Datagram Protocol, Src Port: 49152, Dst Port: 3784
        Source Port: 49152
        Destination Port: 3784
        Length: 32
        Checksum: 0x73b3 [unverified]
        [Checksum Status: Unverified]
        [Stream index: 647]
Chuckc gravatar imageChuckc ( 2024-02-07 03:11:24 +0000 )edit

... or is the size of the captured packets limited, so that part of the data is missing?

Jaap gravatar imageJaap ( 2024-02-07 06:22:44 +0000 )edit
77  17.531456   192.168.200.182 192.168.200.1   DNS 74  Standard query 0xd5b2[Packet size limited during capture]

Frame 77: 74 bytes on wire (592 bits), 48 bytes captured (384 bits) on interface \Device\NPF_{xxx}, id 0
Ethernet II, Src: LiteonTechno_xxx (xxx), Dst: Ubiquiti_xxx (xxx)
Internet Protocol Version 4, Src: 192.168.200.182, Dst: 192.168.200.1
User Datagram Protocol, Src Port: 55288, Dst Port: 53
    Source Port: 55288
    Destination Port: 53
    Length: 40
    Checksum: 0xb10c [unverified]
    [Checksum Status: Unverified]
    [Stream index: 0]
    [Timestamps]
    UDP payload (6 bytes)
Domain Name System (query)
[Packet size limited during capture: DNS truncated]

Display filters to find short frames:
frame.cap_len < frame.len
udp && _ws.short
Message may not be display in the Info column if frame.disable_packet_size_limited_in_summary set to false.

Chuckc gravatar imageChuckc ( 2024-02-07 12:55:34 +0000 )edit