python - 校验和 icmp python 与wireshark

Question

在过去的几天里，我对 ICMP 协议(protocol)充满了热情，并且发现了一个计算其校验和的 python 函数:

def carry_around_add(a, b):
    c = a + b
    return (c & 0xffff) + (c >> 16)

def checksum(msg):
   s = 0
   for i in range(0, len(msg), 2):
       w = ord(msg[i]) + (ord(msg[i+1]) << 8)
       s = carry_around_add(s, w)
   return ~s & 0xffff

print checksum("abcdefghijklmnopqrst")

在这张wireshark捕获的图片中:

校验和为“0xcfcb”，但我的测试中的函数返回“55 245 -> 0xd7cd”。为什么 ？

非常感谢=)

Answer 1

您的wireshark转储显示了ICMP校验和，但是(wikipedia):

The third and fourth bytes are a checksum of the entire ICMP message.

...

Checksum – Error checking data, calculated from the ICMP header and data, with value 0 substituted for this field. The Internet Checksum is used, specified in RFC 1071.

您在测试中对校验和例程的输入只是 ASCII 有效负载部分。您必须提供完整的 ICMP 输入。

<小时/>

例如:

def carry_around_add(a, b):
    c = a + b
    return (c & 0xffff) + (c >> 16)

def checksum(msg):
   s = 0
   for i in range(0, len(msg), 2):
       w = ord(msg[i]) + (ord(msg[i+1]) << 8)
       s = carry_around_add(s, w)
   return ~s & 0xffff

payload_body = "abcdefghijklmnopqrst"
chk = checksum(payload_body)
print chk, '{:x}'.format(chk), '(host byte order)'

msg_type = '\x08' # ICMP Echo Request
msg_code = '\x00' # must be zero
msg_checksum_padding = '\x00\x00' # "...with value 0 substituted for this field..."
rest_header = '\x00\x01\x00\x01' # from pcap
entire_message = msg_type + msg_code + msg_checksum_padding + rest_header + payload_body
entire_chk = checksum(entire_message)
print entire_chk, '{:x}'.format(entire_chk), '(host byte order)'

当我在我的(小端)机器上运行它时，我得到:

$ ./icmp_checksum_test.py 
52695 cdd7 (host byte order)
52175 cbcf (host byte order)