This IPv4 header checksum calculator and decoder reads a header pasted as hex, explains every field and checks the header checksum. It can also build a header from fields with the correct checksum, for lab work and learning. It runs entirely in your browser: nothing you type is sent to our server.
Loading the tool… It runs in your browser and needs JavaScript.
Table of Contents
Where to get the hex
tcpdump -i eth0 -c 1 -x host 192.0.2.10 # hex of each packet, starting at the IP header
tcpdump -i eth0 -c 1 -xx host 192.0.2.10 # includes the 14-byte Ethernet header: skip itIn Wireshark, right-click the Internet Protocol line and choose Copy → as Hex Stream.
How the IPv4 header checksum works
The IPv4 header checksum is the ones’ complement of the ones’ complement sum of the header’s 16-bit words, with the checksum field counted as zero. Routers recalculate it at every hop because the TTL changes. A wrong checksum in a capture taken on the sending host is usually checksum offload: the network card fills it in after the capture point.
Fields worth knowing
- DSCP: QoS marking (46 = EF for voice, 34 = AF41 for video).
- DF flag: set by most modern TCP stacks for path MTU discovery.
- TTL: 64 (Linux), 128 (Windows) or 255 (many routers) at the source, minus one per hop.
Checking an IPv4 header checksum by hand
- Set the checksum field (bytes 10 and 11) to zero.
- Add the header as 16-bit words using one’s complement addition: any carry out of the top bit is added back at the bottom.
- Invert the result. That is the IPv4 header checksum.
- To verify a received header, add every word including the checksum: the result must be
FFFF.
Worked example, a 20-byte header with the checksum zeroed:
4500 0073 0000 4000 4011 0000 c0a8 0001 c0a8 00c7
sum with carries folded = 479e
checksum = NOT 479e = b861
verify: sum including b861 = ffffCommon mistakes:
- Trusting a capture taken on the sending host: with checksum offload the network card fills in the checksum later, so tcpdump shows it as wrong or zero.
- Expecting the checksum to stay the same along the path: every router lowers the TTL and recalculates it.
- Looking for a header checksum in IPv6: there is none; IPv6 relies on the link layer and the transport checksums.
Related tools and guides: number base converter, IP address converter, MPLS label decoder, subnet calculator.
How we checked it
We tested the tool on 11-12 October 2026 with the standard example header 4500 0073 0000 4000 4011 b861 c0a8 0001 c0a8 00c7 (checksum b861 verified), a header with the checksum zeroed, and by rebuilding the same header from its fields.
References: the IPv4 header is defined in RFC 791, and the checksum algorithm in
Frequently asked questions
How is the IPv4 header checksum calculated?
Add the header’s 16-bit words with the checksum field set to zero, fold any carry back in, and take the ones’ complement of the result.
Why does Wireshark say my checksum is wrong?
If you captured on the sending machine, the network card probably calculates the checksum after capture (offload). Captures from another machine show the real value.
Does IPv6 have a header checksum?
No. IPv6 removed it; the link layer and upper-layer checksums cover errors.