Home/ Questions/Q 4172766
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-21T00:36:09+00:00

While looking at messages in Wireshark, I have noted that Checksum validation is always

  • 0

While looking at messages in Wireshark, I have noted that Checksum validation is always disabled. Is it like an obsolete requirement, or does it apply to internet traffic only which goes outside the firewall of a company network?

Also, can someone please advice how it is set (eg., whether from an application or network card setting, etc.)

PS: The question might not be of practical significance. I am asking this to fill the large missing gaps in my poor network programming skills. I had heard that checksum validation is a major bottleneck for tcp communication, but am surprised that it is disabled for all messages that I have seen

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    This question is answered in the Wireshark FAQ.

    The upshot is that checksums are generally calculated by network cards, and Wireshark often intercepts packets before they hit the hardware that does the actual calculation. Enabling validation for those packets results in a large number of errors, so they disabled validation by default. More info is available via the link.

    Edit: just to address fruit’s comment below, I screenshotted a couple of TCP packets for comparison. The first one is a TCP packet without validation:

    Validation disabled

    You can see that there is a non-zero checksum there, so it might appear that Wireshark (or some other pre-hardware app) has done the checksum for you. However, when we turn validation on for this same packet..

    enter image description here

    Now we can see that this checksum wasn’t valid in the first place. I can’t find a source for this info, but I think it’s strong evidence that Wireshark is not populating that field for us; doing so would go against Wireshark’s nature anyway. Instead, I expect that this is just an uninitialized field in the packet – it takes more work to set a field to zero than to omit setting it at all.

    It’s also worth noting that as time goes on, more and more network stacks will be offloading checksumming to the hardware, so there will be fewer and fewer cases of valid checksums coming from the local machine.

    • 0