TheInternet checksum,[1][2] also called theIPv4 header checksum is achecksum used inversion 4 of theInternet Protocol (IPv4) to detect corruption in the header of IPv4 packets. It is carried in theIPv4 packet header, and represents the 16-bit result of the summation of the header words.[3]
TheIPv6 protocol does not use header checksums. Its designers considered that the whole-packet link layer checksumming provided in protocols, such asPPP andEthernet, combined with the use of checksums in upper layer protocols such asTCP andUDP, are sufficient.[4] Thus, IPv6 routers are relieved of the task of recomputing the checksum whenever the packet changes, for instance by the lowering of thehop limit counter on every hop.
The Internet checksum is mandatory to detect errors in IPv6 UDP packets (including data payload).
The Internet checksum is used to detect errors in ICMP packets (including data payload).
The checksum calculation is defined as follows:[5]
The checksum field is the 16 bitone's complement of the one's complement sum of all 16 bit words in the header. For purposes of computing the checksum, the value of the checksum field is zero.
If there is no corruption, the result of summing the entire IP header, including checksum, and then taking its one's complement should be zero. At each hop, the checksum is verified. Packets with checksum mismatch are discarded. The router must adjust the checksum if it changes the IP header (such as when decrementing the TTL).[6]
The procedure is explained in detail in RFC 1071 "Computing the Internet Checksum".[1] Optimizations are presented in RFC 1624 "Computation of the Internet Checksum via Incremental Update",[2] to cover the case in routers that need to recompute the header checksum during packet forwarding when only a single field has changed.
Take the following truncated excerpt of an IPv4 packet. The header is shown in bold and the checksum is underlined.
4500 0073 0000 4000 4011b861 c0a8 0001c0a8 00c7 0035 e97c 005f 279f 1e4b 8180
For ones' complement addition, each time a carry occurs, we must add a 1 to the sum.[7] A carry check and correction can be performed with each addition or as a post-process after all additions. If another carry is generated by the correction, another 1 is added to the sum.
To calculate the checksum, we can first calculate the sum of each 16-bit value within the header, skipping only the checksum field itself. Note that these values are inhexadecimal notation.
Initial addition:4500 + 0073 + 0000 + 4000 + 4011 + c0a8 + 0001 + c0a8 + 00c7 = 2479c
Carry addition is then made by adding the fifth hexadecimal digit to the first 4 digits:2 + 479c = 479e
The checksum is then theones' complement (bitwise NOT) of this result:NOT 479e = b861
This checksum value is shown as underlined in the original IP packet header above.
When verifying a checksum, the same procedure is used as above, except that the original header checksum is not omitted.4500 + 0073 + 0000 + 4000 + 4011 + b861 + c0a8 + 0001 + c0a8 + 00c7 = 2fffd
Add the carry bits:fffd + 2 = ffff
Taking the ones' complement (flipping every bit) yields 0000, which indicates that no error is detected.IP header checksum does not check for the correct order of 16-bit values within the header.