Simson L. Garfinkel

This is really helpful. Thanks.

@erik4711 - can you get me a copy of the pcap file? It seems that the IPv6 LLMNR may not be validating in my IPv6 validator. Thanks.

At offset 1063526424 is the packet that includes the string `xzignbnfvi`. [Here is how the packet decodes.](https://hpd.gasmi.net/?data=6000000000241101FE80000000000000C46B00E40D5562B1FF020000000000000000000000010003F99E14EB002421DC7E2A000000010000000000000A787A69676E626E6676690000010001A6CAB270F8672F3F&force=ipv6) Packet dump: ``` (base) simsong@Seasons ~ % xxd -g 1 memdump-1063526424.pkt | cut...

Apparently, the IPv6 checksum (`0xdc21`) is not being properly computed.

Thank you. I have determined that the bulk_extractor ipv6 udp checksum computation is incorrect, which is why the ipv6 carving was not working properly. Do you have a validated IPv6...

I've looked and can't easily find it. Do you know where it is? Would you be willing to look over my implementation and provide me with test cases? I'm mostly...

Thanks. As I feared, that code is not usable for me. I can't figure out what it is doing. And, to be fair, that appears to be ipv4 checksum, not...

Thank you. I know the algorithms. It is wireshark code that I cannot figure out. I have code for the UDPv6 working, but my packet has an even number of...

Thanks. I have a basic IPv6 UDP checksum operational. It works for a test packet that I found on StackOverflow but it doesn't work for the packet that I carved...

@erik4711 - Some of the packets from caploader have some bad checksums: ``` slg@lastdance ~ % tcpdump -r memdump.mem.pcapng -vvn reading from PCAP-NG file memdump.mem.pcapng -3:-59:-34.770452 IP6 (hlim 128, next-header...