Intranet 与 Internet 应用程序中的校验和验证
在查看 Wireshark 中的消息时，我注意到校验和验证始终处于禁用状态。这是一个过时的要求，还是仅适用于公司网络防火墙之外的互联网流量？
另外，有人可以建议它是如何设置的（例如，是从应用程序还是网卡设置等）
PS：这个问题可能没有实际意义。我要求这个来填补我糟糕的网络编程技能中巨大的缺失空白。我听说校验和验证是 tcp 通信的主要瓶颈，但令我惊讶的是，我看到的所有消息都禁用了它
While looking at messages in Wireshark, I have noted that Checksum validation is always disabled. Is it like an obsolete requirement, or does it apply to internet traffic only which goes outside the firewall of a company network?
Also, can someone please advice how it is set (eg., whether from an application or network card setting, etc.)
PS: The question might not be of practical significance. I am asking this to fill the large missing gaps in my poor network programming skills. I had heard that checksum validation is a major bottleneck for tcp communication, but am surprised that it is disabled for all messages that I have seen
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
此问题在 Wireshark 常见问题解答中得到解答。
结果是校验和通常由网卡计算，而 Wireshark 经常在数据包到达进行实际计算的硬件之前拦截它们。对这些数据包启用验证会导致大量错误，因此它们默认禁用验证。可通过链接获取更多信息。
编辑：为了解决下面水果的评论，我截取了几个 TCP 数据包进行比较。第一个是未经验证的 TCP 数据包：
您可以看到那里有一个非零校验和，所以Wireshark（或其他一些预硬件应用程序）可能已经为您完成了校验和。然而，当我们对同一个数据包打开验证时..
现在我们可以看到这个校验和不是'首先是有效的。我找不到此信息的来源，但我认为这是强有力的证据，表明 Wireshark 没有为我们填充该字段；无论如何，这样做都会违背 Wireshark 的本质。相反，我希望这只是数据包中未初始化的字段 - 将字段设置为零比完全省略设置需要更多的工作。
还值得注意的是，随着时间的推移，越来越多的网络堆栈将把校验和卸载到硬件，因此来自本地计算机的有效校验和的情况会越来越少。
This question is answered in the Wireshark FAQ.
The upshot is that checksums are generally calculated by network cards, and Wireshark often intercepts packets before they hit the hardware that does the actual calculation. Enabling validation for those packets results in a large number of errors, so they disabled validation by default. More info is available via the link.
Edit: just to address fruit's comment below, I screenshotted a couple of TCP packets for comparison. The first one is a TCP packet without validation:
You can see that there is a non-zero checksum there, so it might appear that Wireshark (or some other pre-hardware app) has done the checksum for you. However, when we turn validation on for this same packet..
Now we can see that this checksum wasn't valid in the first place. I can't find a source for this info, but I think it's strong evidence that Wireshark is not populating that field for us; doing so would go against Wireshark's nature anyway. Instead, I expect that this is just an uninitialized field in the packet - it takes more work to set a field to zero than to omit setting it at all.
It's also worth noting that as time goes on, more and more network stacks will be offloading checksumming to the hardware, so there will be fewer and fewer cases of valid checksums coming from the local machine.