Calculation Process — Checksum | OneNoughtOne

0/107

Computer NetworksError Detection & Correction

Checksum

LevelIntermediate

Duration75 mins

TopicError Detection & Correction

4 / 5

Calculation Process

From Theory to Practice

We've explored the mathematical foundations—the checksum concept, Internet checksum specification, and one's complement arithmetic. Now it's time to put this knowledge into practice. In this page, we'll walk through checksum calculation step by step, from raw bytes to verified integrity. You'll see exactly how checksums are computed for IPv4 headers, calculate TCP and UDP checksums with pseudo-headers, understand the intricacies of partial computations, and learn to debug checksum failures. By the end, you'll be able to compute Internet checksums by hand, implement them in any programming language, and diagnose checksum-related issues in network debugging.

What You Will Learn

By the end of this page, you will master the complete checksum calculation process: dividing data into words, computing one's complement sums, handling odd bytes, applying the final complement, and verifying received data. You'll work through detailed examples for IP, TCP, and UDP.

The General Algorithm

Before diving into protocol-specific details, let's establish the universal algorithm that applies to all Internet checksums. Step-by-Step Algorithm:

Checksum Calculation Steps

•Initialize: Set the checksum field in the header to zero (0x0000).
•Prepare pseudoheader (if applicable): Construct the pseudo-header from IP addresses and other info.
•Concatenate: Form the complete data block: [pseudo-header (if any)] + [header] + [payload].
•Pad if necessary: If total length is odd, append a zero byte for calculation purposes.
•Divide into 16-bit words: Treat consecutive byte pairs as big-endian 16-bit integers.
•Sum with one's complement: Add all words using one's complement arithmetic (with end-around carry).
•Complement the result: Take the one's complement (bitwise NOT) of the final sum.
•Insert checksum: Place the result in the checksum field of the header.

Verification Algorithm: Compute the one's complement sum of the entire data block (including the checksum field) If the result is 0xFFFF (all ones), the checksum is valid If the result is anything else, an error occurred Why Verification Works: When computing the checksum, we calculated: checksum = ~sum(data_with_zero_checksum) When verifying, we compute: sum(data_with_checksum) = sum(other_words) + checksum Since checksum = ~sum(other_words), we get: sum(other_words) + ~sum(other_words) = 0xFFFF (in one's complement) This beautiful algebraic identity makes verification simple and fast.

Memory Trick

Think of the checksum as the 'missing piece' that makes the sum complete. Just like adding a number and its negative gives zero, adding a sum and its complement gives all-ones. The receiver checks if all pieces fit together perfectly.

IPv4 Header Checksum: Complete Walkthrough

The IPv4 header checksum is the simplest Internet checksum to compute—it covers only the header with no pseudo-header involved. Let's work through a complete example. Sample IPv4 Header (20 bytes, no options):

IPv4 Header Field Values
Byte Offset	Field	Value (Hex)	Value (Binary/Meaning)
0	Version + IHL	0x45	Version 4, IHL 5 (20 bytes)
1	DSCP + ECN	0x00	Default service
2-3	Total Length	0x00 0x3C	60 bytes total packet
4-5	Identification	0x1C 0x46	ID: 7238
6-7	Flags + Fragment	0x40 0x00	Don't fragment, offset 0
8	TTL	0x40	64 hops
9	Protocol	0x06	TCP (6)
10-11	Header Checksum	0x00 0x00	← Zero for calculation
12-15	Source IP	0xAC 0x10 0x0A 0x63	172.16.10.99
16-19	Dest IP	0xAC 0x10 0x0A 0x0C	172.16.10.12

ipv4_checksum_calculation.py
Python
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
"""
Step-by-step IPv4 header checksum calculation.
"""
 
# The IPv4 header as bytes (with checksum field set to zero)
ip_header = bytes([
    0x45, 0x00,  # Word 0: Version/IHL + DSCP/ECN
    0x00, 0x3C,  # Word 1: Total Length (60 bytes)
    0x1C, 0x46,  # Word 2: Identification
    0x40, 0x00,  # Word 3: Flags + Fragment Offset
    0x40, 0x06,  # Word 4: TTL (64) + Protocol (TCP=6)
    0x00, 0x00,  # Word 5: Header Checksum (zero for calculation)
    0xAC, 0x10,  # Word 6: Source IP (first half) 172.16.x.x
    0x0A, 0x63,  # Word 7: Source IP (second half) x.x.10.99
    0xAC, 0x10,  # Word 8: Dest IP (first half) 172.16.x.x
    0x0A, 0x0C   # Word 9: Dest IP (second half) x.x.10.12
])
 
print("=== IPv4 Header Checksum Calculation ===")
print(f"Header bytes: {ip_header.hex()}")
print()
 
# Step 1: Divide into 16-bit words
words = []
for i in range(0, len(ip_header), 2):
    word = (ip_header[i] << 8) | ip_header[i + 1]
    words.append(word)
    
print("Step 1: Divide into 16-bit words (big-endian)")
for i, word in enumerate(words):
    print(f"  Word {i}: 0x{word:04X} ({word})")
print()
 
# Step 2: Sum all words
total = 0
print("Step 2: Sum all words")
for i, word in enumerate(words):
    old_total = total
    total += word
    carry = total >> 16
    if carry:
        print(f"  {old_total:05X} + {word:04X} = {total:05X} (carry!)")
    else:
        print(f"  {old_total:05X} + {word:04X} = {total:05X}")
 
print(f"  Raw sum: 0x{total:05X}")
print()
 
# Step 3: Fold to 16 bits (end-around carry)
print("Step 3: Fold 32-bit sum to 16 bits")
while total > 0xFFFF:
    high = total >> 16
    low = total & 0xFFFF
    print(f"  0x{high:04X} + 0x{low:04X} = 0x{high + low:04X}")
    total = high + low
    
print(f"  Folded sum: 0x{total:04X}")
print()
 
# Step 4: Take one's complement
checksum = (~total) & 0xFFFF
print("Step 4: Take one's complement")
print(f"  ~0x{total:04X} = 0x{checksum:04X}")
print()
 
print(f"=== FINAL CHECKSUM: 0x{checksum:04X} ===")
 
# Verification
print()
print("=== Verification ===")
# Insert checksum and recompute
header_with_cs = bytearray(ip_header)
header_with_cs[10] = (checksum >> 8) & 0xFF
header_with_cs[11] = checksum & 0xFF
 
verify_sum = 0
for i in range(0, len(header_with_cs), 2):
    word = (header_with_cs[i] << 8) | header_with_cs[i + 1]
    verify_sum += word
 
while verify_sum > 0xFFFF:
    verify_sum = (verify_sum >> 16) + (verify_sum & 0xFFFF)
 
print(f"Sum with checksum included: 0x{verify_sum:04X}")
print(f"Valid (== 0xFFFF): {verify_sum == 0xFFFF}")

IP Checksum Scope

The IPv4 header checksum covers ONLY the IP header (20-60 bytes), not the payload. Each router along the path must recompute this checksum because it modifies the TTL field. The payload is protected by transport-layer checksums (TCP/UDP).

TCP Checksum with Pseudo-Header

TCP checksums are more complex because they include a pseudo-header containing information from the IP layer. This provides end-to-end protection that catches certain routing errors. The TCP Pseudo-Header (12 bytes for IPv4):

TCP Pseudo-Header Structure
Bytes	Field	Description
0-3	Source IP Address	From IP header
4-7	Destination IP Address	From IP header
8	Zero	Reserved (must be zero)
9	Protocol	TCP = 6
10-11	TCP Length	TCP header + data length in bytes

The calculation covers: Pseudo-Header (12 bytes) + TCP Header (20+ bytes) + TCP Payload (variable) The pseudo-header is never transmitted—it's synthesized from the IP header for checksum purposes only.

tcp_checksum_calculation.py
Python
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
"""
Complete TCP checksum calculation with pseudo-header.
"""
import struct
 
def internet_checksum(data: bytes) -> int:
    """Compute Internet checksum over byte sequence."""
    if len(data) % 2 == 1:
        data = data + b'\x00'
    
    total = 0
    for i in range(0, len(data), 2):
        word = (data[i] << 8) | data[i + 1]
        total += word
    
    while total > 0xFFFF:
        total = (total >> 16) + (total & 0xFFFF)
    
    return (~total) & 0xFFFF
 
 
# Example: TCP SYN packet
print("=== TCP Checksum Calculation ===")
print()
 
# IP addresses
src_ip = "192.168.1.100"
dst_ip = "10.0.0.50"
 
# Parse IPs to bytes
import socket
src_ip_bytes = socket.inet_aton(src_ip)
dst_ip_bytes = socket.inet_aton(dst_ip)
 
print(f"Source IP:      {src_ip} -> {src_ip_bytes.hex()}")
print(f"Destination IP: {dst_ip} -> {dst_ip_bytes.hex()}")
print()
 
# TCP Header (20 bytes, no options)
tcp_header = bytes([
    0x04, 0xD2,  # Source Port: 1234
    0x00, 0x50,  # Dest Port: 80
    0x00, 0x00, 0x01, 0x00,  # Sequence Number: 256
    0x00, 0x00, 0x00, 0x00,  # Ack Number: 0
    0x50, 0x02,  # Data Offset (5 words=20 bytes), Flags (SYN)
    0x72, 0x10,  # Window Size: 29200
    0x00, 0x00,  # Checksum: 0 (to be calculated)
    0x00, 0x00   # Urgent Pointer: 0
])
 
# TCP Payload
tcp_payload = b"Hello, World!"
 
print("TCP Header (with checksum zeroed):")
print(f"  {tcp_header.hex()}")
print(f"TCP Payload: {tcp_payload}")
print()
 
# Build pseudo-header
tcp_length = len(tcp_header) + len(tcp_payload)
pseudo_header = struct.pack(
    "!4s4sBBH",
    src_ip_bytes,      # Source IP (4 bytes)
    dst_ip_bytes,      # Dest IP (4 bytes)
    0,                 # Reserved (1 byte)
    6,                 # Protocol: TCP (1 byte)
    tcp_length         # TCP Length (2 bytes)
)
 
print("Pseudo-Header:")
print(f"  {pseudo_header.hex()}")
print(f"  - Source IP:  {src_ip_bytes.hex()}")
print(f"  - Dest IP:    {dst_ip_bytes.hex()}")
print(f"  - Zero:       00")
print(f"  - Protocol:   06 (TCP)")
print(f"  - TCP Length: {tcp_length} bytes (0x{tcp_length:04X})")
print()
 
# Concatenate all: pseudo-header + TCP header + payload
checksum_data = pseudo_header + tcp_header + tcp_payload
 
print(f"Total checksum data: {len(checksum_data)} bytes")
print()
 
# Compute checksum
checksum = internet_checksum(checksum_data)
print(f"=== COMPUTED CHECKSUM: 0x{checksum:04X} ===")
print()
 
# Verification: insert checksum and verify
tcp_header_with_cs = bytearray(tcp_header)
tcp_header_with_cs[16] = (checksum >> 8) & 0xFF
tcp_header_with_cs[17] = checksum & 0xFF
 
verify_data = pseudo_header + bytes(tcp_header_with_cs) + tcp_payload
verify_sum = internet_checksum(verify_data)
# For verification, we check if sum is 0 (complement of 0xFFFF)
# Actually, we need to check sum before complement equals 0xFFFF
 
total = 0
if len(verify_data) % 2 == 1:
    verify_data = verify_data + b'\x00'
for i in range(0, len(verify_data), 2):
    word = (verify_data[i] << 8) | verify_data[i + 1]
    total += word
while total > 0xFFFF:
    total = (total >> 16) + (total & 0xFFFF)
 
print("=== Verification ===")
print(f"Sum with checksum included: 0x{total:04X}")
print(f"Valid (== 0xFFFF): {total == 0xFFFF}")

Common Mistake

Forgetting to include the pseudo-header is the most common TCP checksum bug. The checksum MUST cover: pseudo-header + TCP header (with checksum field zeroed) + TCP payload. Missing any component produces invalid packets that receivers will drop.

UDP Checksum

UDP checksum calculation is nearly identical to TCP, but with important differences: Optional in IPv4 : The checksum field can be set to 0x0000 to skip verification (though RFC recommends computing) Mandatory in IPv6 : Since IPv6 has no header checksum, UDP must provide protection Zero-ambiguity : If the computed checksum is 0x0000, transmit 0xFFFF instead (both represent zero in one's complement)

UDP Pseudo-Header Structure
Bytes	Field	Description
0-3	Source IP Address	From IP header
4-7	Destination IP Address	From IP header
8	Zero	Reserved
9	Protocol	UDP = 17 (0x11)
10-11	UDP Length	UDP header (8) + data length

udp_checksum_calculation.py
Python
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
"""
UDP checksum calculation with all edge cases handled.
"""
import struct
import socket
 
def internet_checksum(data: bytes) -> int:
    """Compute Internet checksum."""
    if len(data) % 2 == 1:
        data = data + b'\x00'
    
    total = 0
    for i in range(0, len(data), 2):
        word = (data[i] << 8) | data[i + 1]
        total += word
    
    while total > 0xFFFF:
        total = (total >> 16) + (total & 0xFFFF)
    
    result = (~total) & 0xFFFF
    
    # Special case: if checksum is 0, use 0xFFFF instead
    # (Both represent zero in one's complement, but 0x0000
    # means "no checksum computed" in UDP)
    if result == 0x0000:
        result = 0xFFFF
    
    return result
 
 
def compute_udp_checksum(
    src_ip: str,
    dst_ip: str,
    src_port: int,
    dst_port: int,
    payload: bytes
) -> int:
    """
    Compute complete UDP checksum.
    
    Returns the 16-bit checksum value.
    """
    # Build UDP header (8 bytes)
    udp_length = 8 + len(payload)
    udp_header = struct.pack(
        "!HHHH",
        src_port,      # Source port (2 bytes)
        dst_port,      # Dest port (2 bytes)
        udp_length,    # Length (2 bytes)
        0              # Checksum = 0 for calculation (2 bytes)
    )
    
    # Build pseudo-header (12 bytes)
    src_ip_bytes = socket.inet_aton(src_ip)
    dst_ip_bytes = socket.inet_aton(dst_ip)
    
    pseudo_header = struct.pack(
        "!4s4sBBH",
        src_ip_bytes,
        dst_ip_bytes,
        0,           # Reserved
        17,          # Protocol: UDP
        udp_length   # UDP length
    )
    
    # Concatenate and compute
    checksum_data = pseudo_header + udp_header + payload
    return internet_checksum(checksum_data)
 
 
# Example: DNS query packet
print("=== UDP Checksum Calculation (DNS Query) ===")
print()
 
src_ip = "192.168.1.50"
dst_ip = "8.8.8.8"
src_port = 54321
dst_port = 53  # DNS
 
# Simple DNS query payload (asking for google.com A record)
# This is a simplified representation
dns_payload = bytes([
    0x12, 0x34,  # Transaction ID
    0x01, 0x00,  # Flags: Standard query
    0x00, 0x01,  # Questions: 1
    0x00, 0x00,  # Answer RRs: 0
    0x00, 0x00,  # Authority RRs: 0
    0x00, 0x00,  # Additional RRs: 0
    # Query: google.com
    0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,  # "google"
    0x03, 0x63, 0x6f, 0x6d,  # "com"
    0x00,        # Root label
    0x00, 0x01,  # Type: A
    0x00, 0x01   # Class: IN
])
 
print(f"Source:      {src_ip}:{src_port}")
print(f"Destination: {dst_ip}:{dst_port}")
print(f"Payload ({len(dns_payload)} bytes): {dns_payload.hex()}")
print()
 
checksum = compute_udp_checksum(src_ip, dst_ip, src_port, dst_port, dns_payload)
print(f"=== COMPUTED CHECKSUM: 0x{checksum:04X} ===")
print()
 
# Build complete UDP packet
udp_length = 8 + len(dns_payload)
udp_packet = struct.pack(
    "!HHHH",
    src_port,
    dst_port,
    udp_length,
    checksum
) + dns_payload
 
print("Complete UDP packet:")
print(f"  {udp_packet.hex()}")

The Zero Checksum Special Case

In UDP, a checksum field of 0x0000 means 'checksum not computed.' But what if the actual computed checksum equals zero? The solution: transmit 0xFFFF instead. In one's complement, 0x0000 and 0xFFFF both represent zero, so verification still works. This clever trick resolves the ambiguity.

Handling Edge Cases

Real-world checksum implementation must handle several edge cases that don't appear in textbook descriptions. Edge Case 1: Odd-Length Data When the data length is odd, you can't form a complete final 16-bit word. The standard approach: conceptually pad with a zero byte, but only for calculation—the padding is never transmitted.

odd_length_handling.py
Python
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
"""
Handling odd-length data in checksum calculation.
"""
 
def checksum_with_odd_handling(data: bytes) -> int:
    """
    Proper handling of odd-length data.
    """
    total = 0
    length = len(data)
    
    # Process complete 16-bit words
    for i in range(0, length - 1, 2):
        word = (data[i] << 8) | data[i + 1]
        total += word
    
    # Handle trailing odd byte
    if length % 2 == 1:
        # Treat as high byte with implicit zero low byte
        # Network byte order: the byte is MSB
        total += data[-1] << 8
        print(f"Odd byte 0x{data[-1]:02X} treated as 0x{data[-1]:02X}00")
    
    # Fold and complement
    while total > 0xFFFF:
        total = (total >> 16) + (total & 0xFFFF)
    
    return (~total) & 0xFFFF
 
 
# Test with odd-length data
odd_data = bytes([0x45, 0x00, 0x00, 0x3C, 0x1C])  # 5 bytes
print(f"Data (5 bytes): {odd_data.hex()}")
checksum = checksum_with_odd_handling(odd_data)
print(f"Checksum: 0x{checksum:04X}")

Edge Case 2: Empty Data What's the checksum of zero bytes? Technically: Sum = 0 ~0 = 0xFFFF So the checksum of empty data is 0xFFFF. Edge Case 3: All-Zero Data Similarly, if data consists entirely of zero bytes: Sum = 0 (no matter how many zeros) Checksum = 0xFFFF Edge Case 4: All-Ones Data If every word is 0xFFFF (all ones): Sum = 0xFFFF (after folding, since 0xFFFF + 0xFFFF = 0xFFFE + carry = 0xFFFF) Checksum = 0x0000 This is why verification checks for 0xFFFF: correct data sums to 0xFFFF before complement.

Alignment Issues

On some architectures, accessing 16-bit values at odd addresses causes exceptions or performance penalties. High-performance implementations often use byte-by-byte processing to avoid alignment issues, or ensure data is aligned before word-based processing.

Partial Checksums and Combination

In many scenarios, we need to compute checksums over non-contiguous data or combine previously computed partial checksums. The mathematical properties of one's complement addition make this possible. Combining Partial Sums: If you have partial sums computed over different data regions, you can combine them: final_sum = partial_sum_1 \oplus partial_sum_2 \oplus ... \oplus partial_sum_n where \oplus is one's complement addition. Application: Scatter-Gather I/O Network stacks often use scatter-gather I/O where packet data is in non-contiguous memory buffers. Rather than copying everything together, compute partial checksums per buffer and combine.

partial_checksum.py
Python
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
"""
Computing and combining partial checksums.
 
Useful for:
- Scatter-gather I/O (non-contiguous buffers)
- Incremental checksum updates
- Pre-computing pseudo-header contribution
"""
 
def partial_sum(data: bytes) -> int:
    """
    Compute the one's complement sum (before final complement).
    
    Returns the sum, not the checksum!
    """
    if len(data) % 2 == 1:
        data = data + b'\x00'
    
    total = 0
    for i in range(0, len(data), 2):
        word = (data[i] << 8) | data[i + 1]
        total += word
    
    # Fold but don't complement
    while total > 0xFFFF:
        total = (total >> 16) + (total & 0xFFFF)
    
    return total
 
 
def combine_partial_sums(*sums: int) -> int:
    """
    Combine multiple partial sums using one's complement addition.
    """
    total = 0
    for s in sums:
        total += s
    
    while total > 0xFFFF:
        total = (total >> 16) + (total & 0xFFFF)
    
    return total
 
 
def finalize_checksum(sum_value: int) -> int:
    """
    Apply final complement to get checksum from sum.
    """
    return (~sum_value) & 0xFFFF
 
 
# Example: TCP checksum with partial computation
print("=== Partial Checksum Computation ===
")
 
# Pre-compute pseudo-header contribution (can be cached for connection)
pseudo_header = bytes([
    0xC0, 0xA8, 0x01, 0x64,  # Source: 192.168.1.100
    0x0A, 0x00, 0x00, 0x32,  # Dest: 10.0.0.50
    0x00, 0x06,              # Reserved + Protocol (TCP)
    0x00, 0x21               # TCP Length: 33 bytes
])
 
pseudo_sum = partial_sum(pseudo_header)
print(f"Pseudo-header sum: 0x{pseudo_sum:04X}")
 
# TCP header (can be in one buffer)
tcp_header = bytes([
    0x04, 0xD2,  # Source Port: 1234
    0x00, 0x50,  # Dest Port: 80
    0x00, 0x00, 0x01, 0x00,  # Seq
    0x00, 0x00, 0x00, 0x00,  # Ack
    0x50, 0x02, 0x72, 0x10,  # Flags, Window
    0x00, 0x00, 0x00, 0x00   # Checksum (0), Urgent
])
 
header_sum = partial_sum(tcp_header)
print(f"TCP header sum: 0x{header_sum:04X}")
 
# TCP payload (might be in another buffer - scatter-gather)
tcp_payload = b"Hello, World!"  # 13 bytes (odd)
 
payload_sum = partial_sum(tcp_payload)
print(f"Payload sum: 0x{payload_sum:04X}")
 
# Combine all partial sums
combined = combine_partial_sums(pseudo_sum, header_sum, payload_sum)
print(f"Combined sum: 0x{combined:04X}")
 
# Finalize
checksum = finalize_checksum(combined)
print(f"
Final checksum: 0x{checksum:04X}")
 
# Verify by computing directly
direct_data = pseudo_header + tcp_header + tcp_payload
direct_sum = partial_sum(direct_data)
direct_checksum = finalize_checksum(direct_sum)
print(f"Direct checksum: 0x{direct_checksum:04X}")
print(f"Match: {checksum == direct_checksum}")

Performance Optimization

For long-lived TCP connections, the pseudo-header contribution can be pre-computed once when the connection is established. Only the TCP header and payload sums need to be computed per-packet, saving significant overhead for small packets.

Debugging Checksum Failures

Checksum failures are frustrating because they indicate something is wrong but not what. Here's a systematic approach to debugging.

Common Checksum Failure Causes

•Checksum offload not disabled — Capturing packets on the sending machine shows incorrect checksums because the NIC computes them after capture
•Pseudo-header errors — Wrong IP addresses, wrong protocol number, or wrong length in pseudo-header
•Byte-order mistakes — Using host byte order instead of network byte order (or vice versa) for multi-byte fields
•Wrong length — Using packet length instead of segment length, or forgetting options contribute to length
•Modifying data after checksum — NAT or other middleboxes modifying packets without updating checksums
•Memory corruption — Rare but possible: DMA errors, driver bugs, stack overflow corrupting packet data

checksum_debugger.py
Python
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
"""
Checksum debugging utilities.
"""
 
def debug_checksum_failure(
    received_data: bytes,
    checksum_offset: int,
    pseudo_header: bytes = b''
) -> None:
    """
    Analyze a failed checksum to help identify the problem.
    
    Args:
        received_data: The complete received packet/segment
        checksum_offset: Byte offset where checksum field starts
        pseudo_header: Pseudo-header bytes (for TCP/UDP)
    """
    print("=== Checksum Failure Analysis ===
")
    
    # Extract the received checksum
    received_checksum = (received_data[checksum_offset] << 8) | \
                         received_data[checksum_offset + 1]
    print(f"Received checksum: 0x{received_checksum:04X}")
    
    # Zero out the checksum field for recomputation
    data_zeroed = bytearray(received_data)
    data_zeroed[checksum_offset] = 0
    data_zeroed[checksum_offset + 1] = 0
    
    # Recompute expected checksum
    full_data = pseudo_header + bytes(data_zeroed)
    if len(full_data) % 2 == 1:
        full_data = full_data + b'\x00'
    
    total = 0
    print("
Word-by-word breakdown:")
    for i in range(0, len(full_data), 2):
        word = (full_data[i] << 8) | full_data[i + 1]
        print(f"  Offset {i:3d}: 0x{word:04X} ({full_data[i]:02X} {full_data[i+1]:02X})")
        total += word
    
    while total > 0xFFFF:
        total = (total >> 16) + (total & 0xFFFF)
    
    expected_checksum = (~total) & 0xFFFF
    print(f"
Expected checksum: 0x{expected_checksum:04X}")
    print(f"Received checksum: 0x{received_checksum:04X}")
    print(f"Match: {expected_checksum == received_checksum}")
    
    if expected_checksum != received_checksum:
        # Try to identify the discrepancy
        diff = received_checksum ^ expected_checksum
        print(f"
XOR difference: 0x{diff:04X}")
        print(f"Binary diff: {diff:016b}")
        
        # Common error patterns
        if diff == received_checksum:
            print("Hint: Expected checksum is 0 - did you forget the pseudo-header?")
        elif diff == (received_checksum & 0xFF) ^ ((received_checksum >> 8) & 0xFF):
            print("Hint: Possible byte-swap issue")
 
 
# Example usage
print("Example: Analyzing a TCP packet with checksum failure
")
 
# Simulated received TCP segment (with "wrong" checksum)
tcp_segment = bytes([
    0x04, 0xD2, 0x00, 0x50,  # Ports
    0x00, 0x00, 0x01, 0x00,  # Seq
    0x00, 0x00, 0x00, 0x00,  # Ack
    0x50, 0x02, 0x72, 0x10,  # Flags
    0xDE, 0xAD,              # Checksum (intentionally wrong)
    0x00, 0x00               # Urgent
])
 
pseudo_header = bytes([
    0xC0, 0xA8, 0x01, 0x64,
    0x0A, 0x00, 0x00, 0x32,
    0x00, 0x06, 0x00, 0x14
])
 
debug_checksum_failure(tcp_segment, 16, pseudo_header)

Wireshark Tip

When analyzing captures with Wireshark, go to Edit \to Preferences \to Protocols \to TCP and UNCHECK 'Validate the TCP checksum if possible.' Otherwise, Wireshark may mark packets with offloaded (not-yet-computed) checksums as errors, causing confusion.

Computer NetworksError Detection & Correction

Checksum

LevelIntermediate

Duration75 mins

TopicError Detection & Correction

4 / 5

Calculation Process

From Theory to Practice

We've explored the mathematical foundations—the checksum concept, Internet checksum specification, and one's complement arithmetic. Now it's time to put this knowledge into practice. In this page, we'll walk through checksum calculation step by step, from raw bytes to verified integrity. You'll see exactly how checksums are computed for IPv4 headers, calculate TCP and UDP checksums with pseudo-headers, understand the intricacies of partial computations, and learn to debug checksum failures. By the end, you'll be able to compute Internet checksums by hand, implement them in any programming language, and diagnose checksum-related issues in network debugging.

What You Will Learn

By the end of this page, you will master the complete checksum calculation process: dividing data into words, computing one's complement sums, handling odd bytes, applying the final complement, and verifying received data. You'll work through detailed examples for IP, TCP, and UDP.

The General Algorithm

Before diving into protocol-specific details, let's establish the universal algorithm that applies to all Internet checksums. Step-by-Step Algorithm:

Checksum Calculation Steps

•Initialize: Set the checksum field in the header to zero (0x0000).
•Prepare pseudoheader (if applicable): Construct the pseudo-header from IP addresses and other info.
•Concatenate: Form the complete data block: [pseudo-header (if any)] + [header] + [payload].
•Pad if necessary: If total length is odd, append a zero byte for calculation purposes.
•Divide into 16-bit words: Treat consecutive byte pairs as big-endian 16-bit integers.
•Sum with one's complement: Add all words using one's complement arithmetic (with end-around carry).
•Complement the result: Take the one's complement (bitwise NOT) of the final sum.
•Insert checksum: Place the result in the checksum field of the header.

Verification Algorithm: Compute the one's complement sum of the entire data block (including the checksum field) If the result is 0xFFFF (all ones), the checksum is valid If the result is anything else, an error occurred Why Verification Works: When computing the checksum, we calculated: checksum = ~sum(data_with_zero_checksum) When verifying, we compute: sum(data_with_checksum) = sum(other_words) + checksum Since checksum = ~sum(other_words), we get: sum(other_words) + ~sum(other_words) = 0xFFFF (in one's complement) This beautiful algebraic identity makes verification simple and fast.

Memory Trick

Think of the checksum as the 'missing piece' that makes the sum complete. Just like adding a number and its negative gives zero, adding a sum and its complement gives all-ones. The receiver checks if all pieces fit together perfectly.

IPv4 Header Checksum: Complete Walkthrough

The IPv4 header checksum is the simplest Internet checksum to compute—it covers only the header with no pseudo-header involved. Let's work through a complete example. Sample IPv4 Header (20 bytes, no options):

IPv4 Header Field Values
Byte Offset	Field	Value (Hex)	Value (Binary/Meaning)
0	Version + IHL	0x45	Version 4, IHL 5 (20 bytes)
1	DSCP + ECN	0x00	Default service
2-3	Total Length	0x00 0x3C	60 bytes total packet
4-5	Identification	0x1C 0x46	ID: 7238
6-7	Flags + Fragment	0x40 0x00	Don't fragment, offset 0
8	TTL	0x40	64 hops
9	Protocol	0x06	TCP (6)
10-11	Header Checksum	0x00 0x00	← Zero for calculation
12-15	Source IP	0xAC 0x10 0x0A 0x63	172.16.10.99
16-19	Dest IP	0xAC 0x10 0x0A 0x0C	172.16.10.12

ipv4_checksum_calculation.py
Python
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
"""
Step-by-step IPv4 header checksum calculation.
"""
 
# The IPv4 header as bytes (with checksum field set to zero)
ip_header = bytes([
    0x45, 0x00,  # Word 0: Version/IHL + DSCP/ECN
    0x00, 0x3C,  # Word 1: Total Length (60 bytes)
    0x1C, 0x46,  # Word 2: Identification
    0x40, 0x00,  # Word 3: Flags + Fragment Offset
    0x40, 0x06,  # Word 4: TTL (64) + Protocol (TCP=6)
    0x00, 0x00,  # Word 5: Header Checksum (zero for calculation)
    0xAC, 0x10,  # Word 6: Source IP (first half) 172.16.x.x
    0x0A, 0x63,  # Word 7: Source IP (second half) x.x.10.99
    0xAC, 0x10,  # Word 8: Dest IP (first half) 172.16.x.x
    0x0A, 0x0C   # Word 9: Dest IP (second half) x.x.10.12
])
 
print("=== IPv4 Header Checksum Calculation ===")
print(f"Header bytes: {ip_header.hex()}")
print()
 
# Step 1: Divide into 16-bit words
words = []
for i in range(0, len(ip_header), 2):
    word = (ip_header[i] << 8) | ip_header[i + 1]
    words.append(word)
    
print("Step 1: Divide into 16-bit words (big-endian)")
for i, word in enumerate(words):
    print(f"  Word {i}: 0x{word:04X} ({word})")
print()
 
# Step 2: Sum all words
total = 0
print("Step 2: Sum all words")
for i, word in enumerate(words):
    old_total = total
    total += word
    carry = total >> 16
    if carry:
        print(f"  {old_total:05X} + {word:04X} = {total:05X} (carry!)")
    else:
        print(f"  {old_total:05X} + {word:04X} = {total:05X}")
 
print(f"  Raw sum: 0x{total:05X}")
print()
 
# Step 3: Fold to 16 bits (end-around carry)
print("Step 3: Fold 32-bit sum to 16 bits")
while total > 0xFFFF:
    high = total >> 16
    low = total & 0xFFFF
    print(f"  0x{high:04X} + 0x{low:04X} = 0x{high + low:04X}")
    total = high + low
    
print(f"  Folded sum: 0x{total:04X}")
print()
 
# Step 4: Take one's complement
checksum = (~total) & 0xFFFF
print("Step 4: Take one's complement")
print(f"  ~0x{total:04X} = 0x{checksum:04X}")
print()
 
print(f"=== FINAL CHECKSUM: 0x{checksum:04X} ===")
 
# Verification
print()
print("=== Verification ===")
# Insert checksum and recompute
header_with_cs = bytearray(ip_header)
header_with_cs[10] = (checksum >> 8) & 0xFF
header_with_cs[11] = checksum & 0xFF
 
verify_sum = 0
for i in range(0, len(header_with_cs), 2):
    word = (header_with_cs[i] << 8) | header_with_cs[i + 1]
    verify_sum += word
 
while verify_sum > 0xFFFF:
    verify_sum = (verify_sum >> 16) + (verify_sum & 0xFFFF)
 
print(f"Sum with checksum included: 0x{verify_sum:04X}")
print(f"Valid (== 0xFFFF): {verify_sum == 0xFFFF}")

IP Checksum Scope

The IPv4 header checksum covers ONLY the IP header (20-60 bytes), not the payload. Each router along the path must recompute this checksum because it modifies the TTL field. The payload is protected by transport-layer checksums (TCP/UDP).

TCP Checksum with Pseudo-Header

TCP checksums are more complex because they include a pseudo-header containing information from the IP layer. This provides end-to-end protection that catches certain routing errors. The TCP Pseudo-Header (12 bytes for IPv4):

TCP Pseudo-Header Structure
Bytes	Field	Description
0-3	Source IP Address	From IP header
4-7	Destination IP Address	From IP header
8	Zero	Reserved (must be zero)
9	Protocol	TCP = 6
10-11	TCP Length	TCP header + data length in bytes

The calculation covers: Pseudo-Header (12 bytes) + TCP Header (20+ bytes) + TCP Payload (variable) The pseudo-header is never transmitted—it's synthesized from the IP header for checksum purposes only.

tcp_checksum_calculation.py
Python
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
"""
Complete TCP checksum calculation with pseudo-header.
"""
import struct
 
def internet_checksum(data: bytes) -> int:
    """Compute Internet checksum over byte sequence."""
    if len(data) % 2 == 1:
        data = data + b'\x00'
    
    total = 0
    for i in range(0, len(data), 2):
        word = (data[i] << 8) | data[i + 1]
        total += word
    
    while total > 0xFFFF:
        total = (total >> 16) + (total & 0xFFFF)
    
    return (~total) & 0xFFFF
 
 
# Example: TCP SYN packet
print("=== TCP Checksum Calculation ===")
print()
 
# IP addresses
src_ip = "192.168.1.100"
dst_ip = "10.0.0.50"
 
# Parse IPs to bytes
import socket
src_ip_bytes = socket.inet_aton(src_ip)
dst_ip_bytes = socket.inet_aton(dst_ip)
 
print(f"Source IP:      {src_ip} -> {src_ip_bytes.hex()}")
print(f"Destination IP: {dst_ip} -> {dst_ip_bytes.hex()}")
print()
 
# TCP Header (20 bytes, no options)
tcp_header = bytes([
    0x04, 0xD2,  # Source Port: 1234
    0x00, 0x50,  # Dest Port: 80
    0x00, 0x00, 0x01, 0x00,  # Sequence Number: 256
    0x00, 0x00, 0x00, 0x00,  # Ack Number: 0
    0x50, 0x02,  # Data Offset (5 words=20 bytes), Flags (SYN)
    0x72, 0x10,  # Window Size: 29200
    0x00, 0x00,  # Checksum: 0 (to be calculated)
    0x00, 0x00   # Urgent Pointer: 0
])
 
# TCP Payload
tcp_payload = b"Hello, World!"
 
print("TCP Header (with checksum zeroed):")
print(f"  {tcp_header.hex()}")
print(f"TCP Payload: {tcp_payload}")
print()
 
# Build pseudo-header
tcp_length = len(tcp_header) + len(tcp_payload)
pseudo_header = struct.pack(
    "!4s4sBBH",
    src_ip_bytes,      # Source IP (4 bytes)
    dst_ip_bytes,      # Dest IP (4 bytes)
    0,                 # Reserved (1 byte)
    6,                 # Protocol: TCP (1 byte)
    tcp_length         # TCP Length (2 bytes)
)
 
print("Pseudo-Header:")
print(f"  {pseudo_header.hex()}")
print(f"  - Source IP:  {src_ip_bytes.hex()}")
print(f"  - Dest IP:    {dst_ip_bytes.hex()}")
print(f"  - Zero:       00")
print(f"  - Protocol:   06 (TCP)")
print(f"  - TCP Length: {tcp_length} bytes (0x{tcp_length:04X})")
print()
 
# Concatenate all: pseudo-header + TCP header + payload
checksum_data = pseudo_header + tcp_header + tcp_payload
 
print(f"Total checksum data: {len(checksum_data)} bytes")
print()
 
# Compute checksum
checksum = internet_checksum(checksum_data)
print(f"=== COMPUTED CHECKSUM: 0x{checksum:04X} ===")
print()
 
# Verification: insert checksum and verify
tcp_header_with_cs = bytearray(tcp_header)
tcp_header_with_cs[16] = (checksum >> 8) & 0xFF
tcp_header_with_cs[17] = checksum & 0xFF
 
verify_data = pseudo_header + bytes(tcp_header_with_cs) + tcp_payload
verify_sum = internet_checksum(verify_data)
# For verification, we check if sum is 0 (complement of 0xFFFF)
# Actually, we need to check sum before complement equals 0xFFFF
 
total = 0
if len(verify_data) % 2 == 1:
    verify_data = verify_data + b'\x00'
for i in range(0, len(verify_data), 2):
    word = (verify_data[i] << 8) | verify_data[i + 1]
    total += word
while total > 0xFFFF:
    total = (total >> 16) + (total & 0xFFFF)
 
print("=== Verification ===")
print(f"Sum with checksum included: 0x{total:04X}")
print(f"Valid (== 0xFFFF): {total == 0xFFFF}")

Common Mistake

Forgetting to include the pseudo-header is the most common TCP checksum bug. The checksum MUST cover: pseudo-header + TCP header (with checksum field zeroed) + TCP payload. Missing any component produces invalid packets that receivers will drop.

UDP Checksum

UDP checksum calculation is nearly identical to TCP, but with important differences: Optional in IPv4 : The checksum field can be set to 0x0000 to skip verification (though RFC recommends computing) Mandatory in IPv6 : Since IPv6 has no header checksum, UDP must provide protection Zero-ambiguity : If the computed checksum is 0x0000, transmit 0xFFFF instead (both represent zero in one's complement)

UDP Pseudo-Header Structure
Bytes	Field	Description
0-3	Source IP Address	From IP header
4-7	Destination IP Address	From IP header
8	Zero	Reserved
9	Protocol	UDP = 17 (0x11)
10-11	UDP Length	UDP header (8) + data length

udp_checksum_calculation.py
Python
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
"""
UDP checksum calculation with all edge cases handled.
"""
import struct
import socket
 
def internet_checksum(data: bytes) -> int:
    """Compute Internet checksum."""
    if len(data) % 2 == 1:
        data = data + b'\x00'
    
    total = 0
    for i in range(0, len(data), 2):
        word = (data[i] << 8) | data[i + 1]
        total += word
    
    while total > 0xFFFF:
        total = (total >> 16) + (total & 0xFFFF)
    
    result = (~total) & 0xFFFF
    
    # Special case: if checksum is 0, use 0xFFFF instead
    # (Both represent zero in one's complement, but 0x0000
    # means "no checksum computed" in UDP)
    if result == 0x0000:
        result = 0xFFFF
    
    return result
 
 
def compute_udp_checksum(
    src_ip: str,
    dst_ip: str,
    src_port: int,
    dst_port: int,
    payload: bytes
) -> int:
    """
    Compute complete UDP checksum.
    
    Returns the 16-bit checksum value.
    """
    # Build UDP header (8 bytes)
    udp_length = 8 + len(payload)
    udp_header = struct.pack(
        "!HHHH",
        src_port,      # Source port (2 bytes)
        dst_port,      # Dest port (2 bytes)
        udp_length,    # Length (2 bytes)
        0              # Checksum = 0 for calculation (2 bytes)
    )
    
    # Build pseudo-header (12 bytes)
    src_ip_bytes = socket.inet_aton(src_ip)
    dst_ip_bytes = socket.inet_aton(dst_ip)
    
    pseudo_header = struct.pack(
        "!4s4sBBH",
        src_ip_bytes,
        dst_ip_bytes,
        0,           # Reserved
        17,          # Protocol: UDP
        udp_length   # UDP length
    )
    
    # Concatenate and compute
    checksum_data = pseudo_header + udp_header + payload
    return internet_checksum(checksum_data)
 
 
# Example: DNS query packet
print("=== UDP Checksum Calculation (DNS Query) ===")
print()
 
src_ip = "192.168.1.50"
dst_ip = "8.8.8.8"
src_port = 54321
dst_port = 53  # DNS
 
# Simple DNS query payload (asking for google.com A record)
# This is a simplified representation
dns_payload = bytes([
    0x12, 0x34,  # Transaction ID
    0x01, 0x00,  # Flags: Standard query
    0x00, 0x01,  # Questions: 1
    0x00, 0x00,  # Answer RRs: 0
    0x00, 0x00,  # Authority RRs: 0
    0x00, 0x00,  # Additional RRs: 0
    # Query: google.com
    0x06, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,  # "google"
    0x03, 0x63, 0x6f, 0x6d,  # "com"
    0x00,        # Root label
    0x00, 0x01,  # Type: A
    0x00, 0x01   # Class: IN
])
 
print(f"Source:      {src_ip}:{src_port}")
print(f"Destination: {dst_ip}:{dst_port}")
print(f"Payload ({len(dns_payload)} bytes): {dns_payload.hex()}")
print()
 
checksum = compute_udp_checksum(src_ip, dst_ip, src_port, dst_port, dns_payload)
print(f"=== COMPUTED CHECKSUM: 0x{checksum:04X} ===")
print()
 
# Build complete UDP packet
udp_length = 8 + len(dns_payload)
udp_packet = struct.pack(
    "!HHHH",
    src_port,
    dst_port,
    udp_length,
    checksum
) + dns_payload
 
print("Complete UDP packet:")
print(f"  {udp_packet.hex()}")

The Zero Checksum Special Case

In UDP, a checksum field of 0x0000 means 'checksum not computed.' But what if the actual computed checksum equals zero? The solution: transmit 0xFFFF instead. In one's complement, 0x0000 and 0xFFFF both represent zero, so verification still works. This clever trick resolves the ambiguity.

Handling Edge Cases

Real-world checksum implementation must handle several edge cases that don't appear in textbook descriptions. Edge Case 1: Odd-Length Data When the data length is odd, you can't form a complete final 16-bit word. The standard approach: conceptually pad with a zero byte, but only for calculation—the padding is never transmitted.

odd_length_handling.py
Python
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
"""
Handling odd-length data in checksum calculation.
"""
 
def checksum_with_odd_handling(data: bytes) -> int:
    """
    Proper handling of odd-length data.
    """
    total = 0
    length = len(data)
    
    # Process complete 16-bit words
    for i in range(0, length - 1, 2):
        word = (data[i] << 8) | data[i + 1]
        total += word
    
    # Handle trailing odd byte
    if length % 2 == 1:
        # Treat as high byte with implicit zero low byte
        # Network byte order: the byte is MSB
        total += data[-1] << 8
        print(f"Odd byte 0x{data[-1]:02X} treated as 0x{data[-1]:02X}00")
    
    # Fold and complement
    while total > 0xFFFF:
        total = (total >> 16) + (total & 0xFFFF)
    
    return (~total) & 0xFFFF
 
 
# Test with odd-length data
odd_data = bytes([0x45, 0x00, 0x00, 0x3C, 0x1C])  # 5 bytes
print(f"Data (5 bytes): {odd_data.hex()}")
checksum = checksum_with_odd_handling(odd_data)
print(f"Checksum: 0x{checksum:04X}")

Edge Case 2: Empty Data What's the checksum of zero bytes? Technically: Sum = 0 ~0 = 0xFFFF So the checksum of empty data is 0xFFFF. Edge Case 3: All-Zero Data Similarly, if data consists entirely of zero bytes: Sum = 0 (no matter how many zeros) Checksum = 0xFFFF Edge Case 4: All-Ones Data If every word is 0xFFFF (all ones): Sum = 0xFFFF (after folding, since 0xFFFF + 0xFFFF = 0xFFFE + carry = 0xFFFF) Checksum = 0x0000 This is why verification checks for 0xFFFF: correct data sums to 0xFFFF before complement.

Alignment Issues

On some architectures, accessing 16-bit values at odd addresses causes exceptions or performance penalties. High-performance implementations often use byte-by-byte processing to avoid alignment issues, or ensure data is aligned before word-based processing.

Partial Checksums and Combination

In many scenarios, we need to compute checksums over non-contiguous data or combine previously computed partial checksums. The mathematical properties of one's complement addition make this possible. Combining Partial Sums: If you have partial sums computed over different data regions, you can combine them: final_sum = partial_sum_1 \oplus partial_sum_2 \oplus ... \oplus partial_sum_n where \oplus is one's complement addition. Application: Scatter-Gather I/O Network stacks often use scatter-gather I/O where packet data is in non-contiguous memory buffers. Rather than copying everything together, compute partial checksums per buffer and combine.

partial_checksum.py
Python
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
"""
Computing and combining partial checksums.
 
Useful for:
- Scatter-gather I/O (non-contiguous buffers)
- Incremental checksum updates
- Pre-computing pseudo-header contribution
"""
 
def partial_sum(data: bytes) -> int:
    """
    Compute the one's complement sum (before final complement).
    
    Returns the sum, not the checksum!
    """
    if len(data) % 2 == 1:
        data = data + b'\x00'
    
    total = 0
    for i in range(0, len(data), 2):
        word = (data[i] << 8) | data[i + 1]
        total += word
    
    # Fold but don't complement
    while total > 0xFFFF:
        total = (total >> 16) + (total & 0xFFFF)
    
    return total
 
 
def combine_partial_sums(*sums: int) -> int:
    """
    Combine multiple partial sums using one's complement addition.
    """
    total = 0
    for s in sums:
        total += s
    
    while total > 0xFFFF:
        total = (total >> 16) + (total & 0xFFFF)
    
    return total
 
 
def finalize_checksum(sum_value: int) -> int:
    """
    Apply final complement to get checksum from sum.
    """
    return (~sum_value) & 0xFFFF
 
 
# Example: TCP checksum with partial computation
print("=== Partial Checksum Computation ===
")
 
# Pre-compute pseudo-header contribution (can be cached for connection)
pseudo_header = bytes([
    0xC0, 0xA8, 0x01, 0x64,  # Source: 192.168.1.100
    0x0A, 0x00, 0x00, 0x32,  # Dest: 10.0.0.50
    0x00, 0x06,              # Reserved + Protocol (TCP)
    0x00, 0x21               # TCP Length: 33 bytes
])
 
pseudo_sum = partial_sum(pseudo_header)
print(f"Pseudo-header sum: 0x{pseudo_sum:04X}")
 
# TCP header (can be in one buffer)
tcp_header = bytes([
    0x04, 0xD2,  # Source Port: 1234
    0x00, 0x50,  # Dest Port: 80
    0x00, 0x00, 0x01, 0x00,  # Seq
    0x00, 0x00, 0x00, 0x00,  # Ack
    0x50, 0x02, 0x72, 0x10,  # Flags, Window
    0x00, 0x00, 0x00, 0x00   # Checksum (0), Urgent
])
 
header_sum = partial_sum(tcp_header)
print(f"TCP header sum: 0x{header_sum:04X}")
 
# TCP payload (might be in another buffer - scatter-gather)
tcp_payload = b"Hello, World!"  # 13 bytes (odd)
 
payload_sum = partial_sum(tcp_payload)
print(f"Payload sum: 0x{payload_sum:04X}")
 
# Combine all partial sums
combined = combine_partial_sums(pseudo_sum, header_sum, payload_sum)
print(f"Combined sum: 0x{combined:04X}")
 
# Finalize
checksum = finalize_checksum(combined)
print(f"
Final checksum: 0x{checksum:04X}")
 
# Verify by computing directly
direct_data = pseudo_header + tcp_header + tcp_payload
direct_sum = partial_sum(direct_data)
direct_checksum = finalize_checksum(direct_sum)
print(f"Direct checksum: 0x{direct_checksum:04X}")
print(f"Match: {checksum == direct_checksum}")

Performance Optimization

For long-lived TCP connections, the pseudo-header contribution can be pre-computed once when the connection is established. Only the TCP header and payload sums need to be computed per-packet, saving significant overhead for small packets.

Debugging Checksum Failures

Checksum failures are frustrating because they indicate something is wrong but not what. Here's a systematic approach to debugging.

Common Checksum Failure Causes

•Checksum offload not disabled — Capturing packets on the sending machine shows incorrect checksums because the NIC computes them after capture
•Pseudo-header errors — Wrong IP addresses, wrong protocol number, or wrong length in pseudo-header
•Byte-order mistakes — Using host byte order instead of network byte order (or vice versa) for multi-byte fields
•Wrong length — Using packet length instead of segment length, or forgetting options contribute to length
•Modifying data after checksum — NAT or other middleboxes modifying packets without updating checksums
•Memory corruption — Rare but possible: DMA errors, driver bugs, stack overflow corrupting packet data

checksum_debugger.py
Python
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
"""
Checksum debugging utilities.
"""
 
def debug_checksum_failure(
    received_data: bytes,
    checksum_offset: int,
    pseudo_header: bytes = b''
) -> None:
    """
    Analyze a failed checksum to help identify the problem.
    
    Args:
        received_data: The complete received packet/segment
        checksum_offset: Byte offset where checksum field starts
        pseudo_header: Pseudo-header bytes (for TCP/UDP)
    """
    print("=== Checksum Failure Analysis ===
")
    
    # Extract the received checksum
    received_checksum = (received_data[checksum_offset] << 8) | \
                         received_data[checksum_offset + 1]
    print(f"Received checksum: 0x{received_checksum:04X}")
    
    # Zero out the checksum field for recomputation
    data_zeroed = bytearray(received_data)
    data_zeroed[checksum_offset] = 0
    data_zeroed[checksum_offset + 1] = 0
    
    # Recompute expected checksum
    full_data = pseudo_header + bytes(data_zeroed)
    if len(full_data) % 2 == 1:
        full_data = full_data + b'\x00'
    
    total = 0
    print("
Word-by-word breakdown:")
    for i in range(0, len(full_data), 2):
        word = (full_data[i] << 8) | full_data[i + 1]
        print(f"  Offset {i:3d}: 0x{word:04X} ({full_data[i]:02X} {full_data[i+1]:02X})")
        total += word
    
    while total > 0xFFFF:
        total = (total >> 16) + (total & 0xFFFF)
    
    expected_checksum = (~total) & 0xFFFF
    print(f"
Expected checksum: 0x{expected_checksum:04X}")
    print(f"Received checksum: 0x{received_checksum:04X}")
    print(f"Match: {expected_checksum == received_checksum}")
    
    if expected_checksum != received_checksum:
        # Try to identify the discrepancy
        diff = received_checksum ^ expected_checksum
        print(f"
XOR difference: 0x{diff:04X}")
        print(f"Binary diff: {diff:016b}")
        
        # Common error patterns
        if diff == received_checksum:
            print("Hint: Expected checksum is 0 - did you forget the pseudo-header?")
        elif diff == (received_checksum & 0xFF) ^ ((received_checksum >> 8) & 0xFF):
            print("Hint: Possible byte-swap issue")
 
 
# Example usage
print("Example: Analyzing a TCP packet with checksum failure
")
 
# Simulated received TCP segment (with "wrong" checksum)
tcp_segment = bytes([
    0x04, 0xD2, 0x00, 0x50,  # Ports
    0x00, 0x00, 0x01, 0x00,  # Seq
    0x00, 0x00, 0x00, 0x00,  # Ack
    0x50, 0x02, 0x72, 0x10,  # Flags
    0xDE, 0xAD,              # Checksum (intentionally wrong)
    0x00, 0x00               # Urgent
])
 
pseudo_header = bytes([
    0xC0, 0xA8, 0x01, 0x64,
    0x0A, 0x00, 0x00, 0x32,
    0x00, 0x06, 0x00, 0x14
])
 
debug_checksum_failure(tcp_segment, 16, pseudo_header)

Wireshark Tip

When analyzing captures with Wireshark, go to Edit \to Preferences \to Protocols \to TCP and UNCHECK 'Validate the TCP checksum if possible.' Otherwise, Wireshark may mark packets with offloaded (not-yet-computed) checksums as errors, causing confusion.

Calculation Process

From Theory to Practice

The General Algorithm

IPv4 Header Checksum: Complete Walkthrough

TCP Checksum with Pseudo-Header

UDP Checksum

Handling Edge Cases

Partial Checksums and Combination

Debugging Checksum Failures

There’s more to understand.

Calculation Process

From Theory to Practice

The General Algorithm

IPv4 Header Checksum: Complete Walkthrough

TCP Checksum with Pseudo-Header

UDP Checksum

Handling Edge Cases

Partial Checksums and Combination

Debugging Checksum Failures

There’s more to understand.