Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When I run the command

tshark -i 3 -c 100 -V less 1514 src and dst and tcp

The output is:

Transmission Control Protocol, Src Port: commplex-link (5001), Dst Port: 63077 (63077), Seq: 1, Ack: 1, Len: 0

Source port: commplex-link (5001)
Destination port: 63077 (63077)
[Stream index: 0]
Sequence number: 1    (relative sequence number)
Acknowledgement number: 1    (relative ack number)
Header length: 20 bytes
Flags: 0x10 (ACK)
    0... .... = Congestion Window Reduced (CWR): Not set
    .0.. .... = ECN-Echo: Not set
    ..0. .... = Urgent: Not set
    ...1 .... = Acknowledgement: Set
    .... 0... = Push: Not set
    .... .0.. = Reset: Not set
    .... ..0. = Syn: Not set
    .... ...0 = Fin: Not set
Window size: 40960
**Checksum: 0x95e0 [validation disabled]**
    [Good Checksum: False]
    [Bad Checksum: False]

How can I have the TCP checksum field calculated? What command can I use to make this happen?

share|improve this question

migrated from Dec 29 '12 at 8:25

This question came from our site for professional and enthusiast programmers.

tshark -o tcp.check_checksum:TRUE ... will do the trick.


  1. tshark uses the current prefs values from the current profile unless told otherwise. Default values are used if prefs have never been changed & saved (in Wireshark).

  2. tshark -G currentprefs lists the current prefs (descriptive text, pref name & value)

    tshark -G defaultprefs lists the default prefs (ditto).


    tshark -G currentprefs | egrep -B2 "^#?tcp\." will list all the tcp pref names and their current values (along with some descriptive text). Only those prefs not preceeded by # have values other than the default.

If you want to ensure that tshark uses default prefs with only the prefs changes you specify:

tshark -C Default -o tcp.check_checksum:TRUE ...

See tshark -h and the tshark man page for info on the tshark options.

share|improve this answer

You must log in to answer this question.