Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to write a program to generate udp checksum.

to validate my progra, I need some real data. I send a udp packet from one machine to another machine, the packet can be correctly received by the udp server. I captured the packet using tcp dump on both machines

from the udp client machine, the udp packet and pseudo IPV4 header bytes are(HEX format):

pseudo header
src dst ip:    8a60c948 8a60c96d
proto_num len: 0011 0016

UDP header:    83d87d000016 a79e 
      data:    49276d206e6f 742068657265210a

on the udp server machine(receiver):

pseudo header
src dst ip:        8a60c948 8a60c96d
proto_num and len: 0011 0016

UDP header:        83d87d000016 c2c5 
      data:        49276d206e6f 742068657265210a

the checksum should be calculated over


where the checksum field is replaced by 0x0000

but we see that the checksum is changed from 0xa79e on the client to 0xc2c5 on the server side. why this change happens? and which is the correct udp header checksum? thanks!

share|improve this question
yes, they are in the same LAN. if they are not in the same LAN, why it is correct? – user138126 Mar 19 '13 at 13:52
Did you hear the joke about UDP? Nevermind, you wouldn't get it... :P – Canadian Luke May 2 '13 at 18:58
up vote 2 down vote accepted

Some Network Interface Cards (NIC) will "help" you by changing the checksum for you. It is called "Checksum Offloading". A search on that term will help.

share|improve this answer
but the problem is NIC just does the work instead of CPU, it doesn't change the calculation algorithm. So, the same data should deliver the same checksum, am I right? – user138126 Mar 19 '13 at 13:59
ah, OK, the kernel just gives a dirty number on the packet before it sends the checksum to the NIC. – user138126 Mar 19 '13 at 14:56

Try using "tcpdump -K" or similar per your tcpdump man page:

-K            Don't attempt to verify IP, TCP, or UDP checksums.  This is use-
              ful for interfaces that perform some or all  of  those  checksum
              calculation  in  hardware; otherwise, all outgoing TCP checksums
              will be flagged as bad.
share|improve this answer

I catch udp check sum in sender and receiver machine with netfilter in layer3. In side sender, udp checksum doesn't include payload data. In side receiver, udp checksum include payload data. This is reason why udp checksum inconsistency.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.