Ethereal-dev: Re: [Ethereal-dev] Searching for packets with incorrect checksums

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Michael Tuexen <Michael.Tuexen@xxxxxxxxxxxxxxxxx>
Date: Tue, 18 Dec 2001 20:46:41 +0100
Dear all,
thank you very uch for your help. I tried the following:

proto_tree_add_uint(sctp_tree, hf_sctp_source_port, tvb, SOURCE_PORT_OFFSET, SOURCE_PORT_LENGTH, source_port); proto_tree_add_uint(sctp_tree, hf_sctp_destination_port, tvb, DESTINATION_PORT_OFFSET, DESTINATION_PORT_LENGTH, destination_port); proto_tree_add_uint(sctp_tree, hf_sctp_verification_tag, tvb, VERIFICATION_TAG_OFFSET, VERIFICATION_TAG_LENGTH, verification_tag);
    checksum_correct = sctp_checksum_correct(tvb, checksum);
proto_tree_add_uint_format(sctp_tree, hf_sctp_checksum, tvb, CHECKSUM_OFFSET, CHECKSUM_LENGTH, checksum, "Adler-32 checksum: 0x%08x (%u)", checksum, checksum_correct); proto_tree_add_item(sctp_tree, hf_sctp_checksum_correct, tvb, CHECKSUM_OFFSET, CHECKSUM_LENGTH, checksum_correct);
...
    { &hf_sctp_checksum_correct,
      { "Adler-32 checksum correct", "sctp.checksum_correct",
	      FT_BOOLEAN, BASE_NONE, NULL, 0x0,
	      "", HFILL }
    },

The %u is only for debugging. tethereal shows:

Stream Control Transmission Protocol
    Source port: 2907
    Destination port: 2907
    Verification tag: 0x29400a52
    Adler-32 checksum: 0x36010394 (0)
    Adler-32 checksum correct: True
SACK chunk acknowledging TSN 604091652 and reporting 0 gaps and 0 duplicate TSNs

On one line this means that checksum_correct is 0, which means that the checksum is incorrect, on the next line it is TRUE. Hmm. That is why I'm asking how to write the stuff.

Any hints?

Best regards
Michael

On Tuesday, December 18, 2001, at 07:54 PM, Guy Harris wrote:

Dear Guy, Dear all,

"Guy" is a member of "all", so it's not necessary to CC either my home
or my work e-mail address on mail to "ethereal-dev" or "ethereal-users".

Currently I'm calculating the checksum in the dissector and display it
with proto_tree_add_uint_format. I'm trying also to insert in the tree
a boolean variable with proto_tree_add_item (or the hidden version) and
provide a boolean variable as a parameter, which describes oof the
checksum
is right. But this bit is not part of the packet, of course. How can I
do it?

The same way the IP dissector does it:

    if (ipsum == 0) {
	proto_tree_add_uint_format(ip_tree, hf_ip_checksum, tvb,
		offset + 10, 2, iph.ip_sum,
		"Header checksum: 0x%04x (correct)", iph.ip_sum);
    }
    else {
	proto_tree_add_item_hidden(ip_tree, hf_ip_checksum_bad, tvb,
		offset + 10, 2, TRUE);
	proto_tree_add_uint_format(ip_tree, hf_ip_checksum, tvb,
		offset + 10, 2, iph.ip_sum,
		"Header checksum: 0x%04x (incorrect, should be 0x%04x)",
		iph.ip_sum, in_cksum_shouldbe(iph.ip_sum, ipsum));
    }

	...

	static hf_register_info hf[] = {

			...

		{ &hf_ip_checksum,
		{ "Header checksum",	"ip.checksum", FT_UINT16, BASE_HEX,
			NULL, 0x0, "", HFILL }},

		{ &hf_ip_checksum_bad,
		{ "Bad Header checksum",	"ip.checksum_bad", FT_BOOLEAN,
			BASE_NONE, NULL, 0x0, "", HFILL }},

			...

	};

_______________________________________________
Ethereal-dev mailing list
Ethereal-dev@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-dev


Michael.Tuexen@xxxxxxxxxxxxxxxxx