[Winpcap-users] RE: TCP Checksum Calculator

Mark Buchanan Mark.Buchanan at giffels.com
Mon Mar 5 12:49:31 GMT 2007

> I was just wondering whether anyone had implemented a simple TCP
checksum-verifying function for a packet captured through WinPcap. I
need to include one in a simple C-program which I'm writing, but I'd
imagine that it's something which has been coded about 1000 times
before, so I thought I'd see if anyone could kindly help me out -
there's no point in reinventing the wheel!

> Many thanks

> Jonathan

The code below is in VB.NET. For this to work properly as a verification
you need to do the following:

1. Create the TCP pseudo header: see
2. Add the TCP pseudo header to the front of the TCP data byte array.
3. Store the checksum that was sent then clear the checksum bytes in the
4. Pass the array to the subroutine then check the checksum bytes after

I copied this code from: http://www.developerfusion.co.uk/show/2857/2/
and used it to create the a checksum. In 4 years of working with WinPCAP
I have yet to to see an incorrectly transmitted packet - only working on
LANs however.

    ' ICMP requires a checksum that is the one's
    ' complement of the one's complement sum of
    ' all the 16-bit values in the data in the
    ' buffer.
    ' Use this procedure to load the Checksum
    ' field of the buffer.
    ' The Checksum Field (hi and lo bytes) must be
    ' zero before calling this procedure.
    Private Sub CreateChecksum(ByRef data() AsByte, ByVal Size
AsInteger, ByRef HiByte AsByte, 	ByRef LoByte AsByte)
        Dim i AsInteger
        Dim chk As Integer = 0
        For i = 0 To Size - 1 Step 2
            chk += Convert.ToInt32(data(i) * &H100 + data(i + 1))
        chk = Convert.ToInt32((chk And &HFFFF&) + Fix(chk / &H10000&))
        chk += Convert.ToInt32(Fix(chk / &H10000&))
        chk = Not (chk)
        HiByte = Convert.ToByte((chk And &HFF00) / &H100)
        LoByte = Convert.ToByte(chk And &HFF)
    End Sub

Mark Buchanan

Senior Engineer, Controls Systems
Giffels Associates Limited

Mark.Buchanan at giffels.com |  T 416 675 9750 Ext. 5253  |  F 416 798 5559  |  giffels.com

    This communication is intended solely for the addressee(s) and contains information that is privileged, confidential
    and subject to copyright. Any unauthorized use, copying, review or disclosure is prohibited. If received in error,
    please notify us immediately by return e-mail.


More information about the Winpcap-users mailing list