Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I was somehow convinced that the TCP checksum was a header checksum (similar to the IP checksum), but I'm now having doubts reading the Wikipedia article:

The checksum field is the 16 bit one's complement of the one's complement sum of all 16-bit words in the header and text.

This seems a little crazy to me that the TCP checksum, which is placed in the header (as opposed to a footer), depends upon bytes sent after the header. This is a hindrance to hardware optimised TCP. Essentially, this nullifies "cut-through" architectures that would start sending the TCP header before knowing the text of the TCP packet.

Why is the TCP checksum placed in the header when it depends on the text? Can this be mitigated for "cut-through" architectures?

share|improve this question
I think you'll find that building something that modifies the TCP payload without first having the entire packet will be nearly impossible anyway. There are complications because a "unit" of data that you're modifying can be split across packets. The optimization that this prevents is almost never possible anyway. – David Schwartz Dec 4 '12 at 20:00
Are you talking about IP fragmentation? All my TCP packets are in one IP packet. – Randomblue Dec 4 '12 at 20:41
No, I'm talking about TCP segmentation. For example, to change "FOO" to "BAR", you have to consider the fact that the "F" might be the last byte of data in the packet and the next packet may start with "OO". – David Schwartz Dec 4 '12 at 20:44
Hum. I'm working with the FIX protocol, and the payload is quite small (~200 bytes), so it all fits in one TCP packet without any problem. – Randomblue Dec 4 '12 at 20:46
The issue has nothing to do with whether or not it fits. Just because the data can fit in one packet doesn't mean it will be sent in one packet. TCP makes no guarantees about segmentation. – David Schwartz Dec 4 '12 at 20:47
up vote 4 down vote accepted

Yes, the checksum is in the TCP header. Rather than check wiki you can go to the references here: RFC 793 Specifically read section 3 paragraph 1.

When you mention cut-through I assume referring to switching. The switch isn't changing anything in the packet payload so there would be no need to recompute the checksum.

share|improve this answer
Well actually I'm trying to build an application in the spirit of a cut-through switch that would modify the payload a little. This is annoying. – Randomblue Dec 4 '12 at 11:24
It's there to prevent you from doing what you want to do. :) – Nathan V Dec 4 '12 at 11:33

I think you could start with scapy to do packet manipulation in real time.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.