Re: FW: [Q] cksum of UDP packet

One infers from the sample below that you did not include the "UDP Pseudo-header" (IP src/dst address etc.) in the calculation. See Comer/Stevens, RFC 768, or a host of other references for the UDP checksum computation.

I hope that this helps.

From: Qin An [mailto:anqin@anqin.com]
Sent: Tuesday, July 29, 2003 11:41 PM
To: secprog@securityfocus.com
Subject: [Q] cksum of UDP packet

Hi, Glad to meet you all!

I got a problem in cksum computation for UDP packet. At the end of this mail, there is
a function copied from a textbook. I believe it is a universal cksum calculation function.
I captured a UDP packet on the net:

0x07, 0x2c, 0x00, 0x35, 0x00, 0x0c, 0x98, 0x8e, 0x64, 0x69, 0x72, 0x0a

The 6th and 7th element is the cksum computed by the sender's kernel. My question is that
when I use in_cksum to compute the cksum, it returns 0x1f22, different from 0x98, 0x8e.
What's wrong here? Is there any other algorithm to compute cksum?

Thank you in advance!

Do you need help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

Qin An

unsigned short in_cksum (unsigned short *ptr, int nbytes) {

   unsigned long sum; /* assumes long == 32 bits */    unsigned short oddbyte, answer; /* assumes short == 16 bits */

   sum = 0;
   while (nbytes > 1){
  sum += *ptr++;
  nbytes -= 2;
  }

/* mop up an odd byte, if necessary */
   if (nbytes == 1){
/* make sure top half is zero */
  oddbyte = 0;
/* one byte only */

• ((unsigned char *) &oddbyte) = *(unsigned char *) ptr; sum += oddbyte; }

  /* add back carry outs from top 16 bits to low 16 bits */
/* add high-16 to low-16 */
   sum = (sum >> 16) + (sum & 0xffff);
/* add carry */

   sum += (sum >> 16);
/* ones-compliment, then truncate to 16 bits */
   answer = (unsigned short)(~sum);
   return answer;
}

unsigned char s[] = {
0x07, 0x2c, 0x00, 0x35, 0x00, 0x0c, 0x98, 0x8e, 0x64, 0x69, 0x72, 0x0a};

int main (int argc, char *argv[])
{

Do you need more help?

In addition to our free technical library, Pantek provides professional IT services to companies who utilize Open Source software: Learn more about Pantek's Technical Support offerings Place an order for 24/7/365 Technical Support here Learn more about Pantek, who we are, and what we do Chat with a Live Operator Related securityfocus.com Links bugtraq certification focus-bsd focus-ids focus-ih focus-linux focus-ms focus-sun focus-unix-other focus-virus forensics incidents libnet linux-secnews ms-secnews pen-test secpapers secprog sectools secureshell security-basics securityjobs sf-news vuln-dev webappsec Request more information about Pantek

   int i;

   s[6] = s[7] = 0;

   i = in_cksum ((unsigned short *) &s[0], 12); }