First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
Ask Your Question
0

No response to field -e "ip.checksum_calculated"

  1. Not getting any response while using tshark on linux with following command for "ip.checksum_calculated"
  2. What will be possible values of "-e ip.checksum.status", and their meaning, as of now getting 2 as response

Command: tshark -P -T fields -E header=n -E separator=\| -E occurrence=f -e frame.time_epoch -e frame.number -e frame.len -e frame.protocols -e ip.checksum -e ip.checksum_calculated -e ip.checksum.status

sandippatel's avatar
1
sandippatel
asked 2021-09-20 07:23:47 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

The checksum is only calculated if the preference ip.check_checksum is true, in the GUI this is set by the IP protocol preference "Validate the IPv4 checksum if possible".

If you add -o ip.check_checksum:true (that's the lower-case letter o, not zero) to your command line the preference will be set for that run of tshark.

grahamb's avatar
23.8k
grahamb
answered 2021-09-20 08:50:56 +0000
edit flag offensive 0 remove flag delete link
more

Comments

add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer