31

The UDP header struct defined at /usr/include/netinet/udp.h is as follows

struct udphdr
{
  u_int16_t source;
  u_int16_t dest;
  u_int16_t len;
  u_int16_t check;
};

What value is stored in the check field of the header? How to verify if the checksum is correct? I meant on what data is the checksum computed? (Is it just the udp header or udp header plus the payload that follows it?)

Thanks.

3 Answers 3

43

The UDP checksum is performed over the entire payload, and the other fields in the header, and some fields from the IP header. A pseudo-header is constructed from the IP header in order to perform the calculation (which is done over this pseudo-header, the UDP header and the payload). The reason the pseudo-header is included is to catch packets that have been routed to the wrong IP address.

Basically, at the receiving end, all the 16-bit words of the headers plus data area are added together (wrapping at 16 bits) and the result is checked against 0xffff.

On the sending side, it's a little more complex. A one's complement sum is performed on all the 16-bit values then the one's complement (i.e., invert all bits) is taken of that value to populate the checksum field (with the extra condition that a calculated checksum of zero will be changed into all one-bits).

The one's complement sum is not just the sum of all the one's complement values. It's a little more complex.

Basically, you have a running 16-bit accumulator starting at zero and you add every 16-bit value to that. Whenever one of those additions results in a carry, the value is wrapped around and you add one to the value again. This effectively takes the carry bit of the 16-bit addition and adds it to the value.


As an aside, and this is pure conjecture on my part but this could probably be efficiently done by use of the ADC (add with carry) instruction rather than ADD (surprisingly enough, add), or whatever equivalent instructions were available on your CPU at the time.

If there were no carry, ADC would just add the zero bit from the carry. In the days when this stuff was done (and yes, unfortunately, I am that old), memory was far more of a constraint than speed, not so much the case nowadays, so saving a few bytes in your code could well elevate you to the level of demi-god-emperor-of-the-universe :-)


Note that you never had to worry about carry the second time around (or a carry of two with the next ADC if you're using that method mentioned in the previous paragraph) since the two largest 16-bit values, when summed, produce (truncated from 0x1fffe) 0xfffe - adding one to that will never cause another carry.

Once the calculated one's complement sum is calculated, has its bits inverted and is inserted into the packet, that will cause the calculation at the receiving end to produce 0xffff, assuming no errors in transmission of course.

It's worth noting that the payload is always padded to ensure there's an integral number of 16-bit words. If it was padded, the length field tells you the actual length.

RFC768 is the specification which details this.

8
  • Thanks for that. I was a bit confused about the Pseudo-Header part..but then the RFC cleared the air.
    – Deepak
    Sep 26, 2009 at 7:03
  • 1
    "All the 16-bit words of the headers (where the UDP checksum is zero) are added and the one's complement (i.e., invert all bits) is what gets put into the checksum field." No, what the RFC says would lead to "All the one's complements (i.e., invert all bits) of the 16-bit words of the headers (where the UDP checksum is zero) are added and the one's complement of that is what gets put into the checksum field." Otherwise perfect answer +1.
    – Joren
    Sep 26, 2009 at 7:17
  • 2
    This isn't right. "One's complement sum" doesn't mean take the one's complement of each word and add them together. It means that you add the words together, and when a carry bit is produced, you add 1 to the running sum. See mathforum.org/library/drmath/view/54379.html . Apr 22, 2010 at 15:51
  • Thanks, @Jim, a bit more research turns up that you're dead right. I was going to say that I was dead wrong but my ego stepped in at the last minute and disallowed it :-). If you think the updated answer is still wrong, please let me know. Cheers.
    – paxdiablo
    Apr 23, 2010 at 2:45
  • 1
    An interesting note about the one's complement checksum, which may have a lot to do with why it was chosen, is that swapping the byte order of the words to be summed will swap the byte order of the sum.
    – supercat
    Feb 8, 2012 at 17:12
3

A nice and easy to understand example of UDP checksum calculation is done by Gerd Hoffmann.

You can google for "net-checksum.c Gerd Hoffmann" or look at the file here:

https://gist.github.com/fxlv/81209bbd150abfeaceb1f85ff076c9f3

You can use net_checksum_tcpudp function, feed it the UDP payload length, proto, src and dst IPs and then the UDP payload itself and it will do the right thing.

At the end you have to call htons() on the checksum and you're good.

0

I was searching the net for some code which will calculate the udp header (with the pseudo ip header as mentioned above).

Finally I found the open-bsd dhclient packet.c:

https://github.com/openbsd/src/blob/master/sbin/dhclient/packet.c

check out the function assemble_udp_ip_header()

1

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.