Q: TCP checksum calculation goes wrong I am trying to get the correct TCP checksum but it fails. I am using C++ and I get the packets of my local network with winpcap and I've tried to calculate their tcp checksums (I've put the correct filter to get only tcp packets). But when I compare my calculated checksum with wireshark tcp checksums, they are not the same.
This is the code I did with C++, it uses bitmap to detect the bit carries.
u_char* tcp_checksum(const u_char* data, int size)
{
    u_char *checksum = new u_char[2]();
    uint16_t sumando = 0;
    bitset<17> total;

    //add ip src and ip dst
    for (int i = 26; i < 33; i++){
        total = sumando + (uint16_t)((datos[i] << 8) + datos[i + 1]);
        sumando += (uint16_t)((datos[i] << 8) + datos[i + 1]);
        if (total[16] == 1)
            sumando++;
        i++;
    }

    //add el zero byte and number of protocol
    total = sumando + (uint16_t)(0x06);
    sumando += (uint16_t)(0x06);
    if (total[16] == 1)
        sumando++;

    /*here I should add the tcp length to complete the tcp pseudo header but i    didnt add anything because I dont know to calculate the tcp len correctly but its not a problem because a lot of times is cero and the tcp still failing.*/

    //okay we have just calculated the pseudoheader.

    //add all tcp header except the 2 bytes of the checksum (20 bytes normally)
    for (int i = 34; i < 54; i++){
        if (i != 50 && i != 52){//no sumo ni padding ni checksum.
            total = sumando + (uint16_t)((datos[i] << 8) + datos[i + 1]);
            sumando += (uint16_t)((datos[i] << 8) + datos[i + 1]);
            if (total[16] == 1)
                sumando++;
        }
        //
        if (i == 52) break;
        i++;
    }


    //add the tcp payload in 16 bits each adding.
    for (int i = 55; i < tamaño - 1; i++){//tamaño - 1
        total = sumando + (uint16_t)((datos[i] << 8) + datos[i + 1]);
        sumando += (uint16_t)((datos[i] << 8) + datos[i + 1]);
        if (total[16] == 1)
            sumando++;
        i++;
    }
    if (tamaño % 2 == 0){
        total = sumando + (uint16_t)((0x00 << 8) + datos[tamaño]);
        sumando += (uint16_t)((0x00 << 8) + datos[tamaño]);
        if (total[16] == 1)
            sumando++;
    }

    //i get the complementary and i divided the u_short (16 bits) (uint16_t) in 2 bytes which i return
    sumando = sumando & 0xFFFF;
    sumando = ~sumando;
    checksum[0] = (sumando >> 8) & 0x00FF;
    checksum[1] = sumando & 0x00FF;
    return checksum;
    }

Okay, when i try to compare between real tcp checksum bytes and my tcp checksum its not the same:

printf("%x%x==", pkt_data[50], pkt_data[51]);
u_char *c = new u_char[2]();
c= tcp_checksum(pkt_data, header->caplen);
printf("%x%x\n", c[0], c[1]);
cout << endl;
delete c;


I get different bytes, normally the bytes 51 and 52 of a packet tcp belong to tcp checksum. When I output them, they are not the same.

A: Don't compare your results with wireshark, at least not without turning off checksum offloading.
Checksums of packets captured through libpcap/winpcap are often wrong due to checksum offloading performed by the network interface card. 
