How UDP Checksum Is Calculated

The User Datagram Protocol (UDP) checksum is a 16-bit error-detection mechanism used to verify the integrity of transmitted data across the transport and network layers. This article explains the exact step-by-step algorithm used to calculate the UDP checksum, including the creation of the IPv4/IPv6 pseudo-header, 16-bit word alignment, one’s complement summation, and receiver verification.

The Three Components of the Checksum

Unlike simpler checksums that only evaluate the payload, the UDP checksum covers three distinct data blocks:

1. The UDP Pseudo-Header: A synthetic header constructed from fields in the IP layer to ensure the packet was routed to the correct destination IP and protocol.
2. The UDP Header: Source Port, Destination Port, Length, and the Checksum field itself.
3. The Data Payload: The actual application-layer data being transmitted.

Step-by-Step Calculation Process

Step 1: Construct the Pseudo-Header

For an IPv4 packet, a 12-byte pseudo-header is generated using: * Source IPv4 Address (32 bits) * Destination IPv4 Address (32 bits) * Zero Padding (8 bits set to 0x00) * Protocol Number (8 bits set to 17 or 0x11 for UDP) * UDP Length (16 bits, matching the length in the UDP header)

(For IPv6, the pseudo-header is 40 bytes long, containing 128-bit source and destination addresses, a 32-bit UDP length, and a “Next Header” field set to 17).

Step 2: Prepare the UDP Header

Place the standard 8-byte UDP header immediately after the pseudo-header. Set the 16-bit Checksum field in the header to 0x0000 for the calculation.

Step 3: Append the Payload and Apply Padding

Append the application data directly after the UDP header. If the payload contains an odd number of octets (bytes), append a single zero byte (0x00) to the end to align the entire buffer to 16-bit (2-byte) boundaries. This padding byte is only used for calculation and is not transmitted.

Step 4: Perform One’s Complement Addition

Divide the entire concatenated buffer (Pseudo-Header + UDP Header + Payload + Padding) into 16-bit words. Add these words together using one’s complement addition:

1. Add all 16-bit words using standard 32-bit integer addition.
2. If the resulting sum exceeds 16 bits (producing a carry value in the upper 16 bits), add the carry bits back into the lower 16 bits: \[\text{Sum} = (\text{Sum} \ \& \ \text{0xFFFF}) + (\text{Sum} \gg 16)\]
3. Repeat the carry addition if another overflow occurs, until the upper 16 bits equal zero.

Step 5: Invert the Final Result

Take the one’s complement (bitwise NOT) of the final 16-bit sum:

\[\text{Checksum} = \sim\text{Sum}\]

Place this 16-bit value into the UDP header’s Checksum field.

Special Handling and Rules

• All Zeros vs. All Ones: In one’s complement arithmetic, 0x0000 (positive zero) and 0xFFFF (negative zero) are equivalent. If the calculated checksum evaluates to 0x0000, it is transmitted as 0xFFFF. In IPv4, a transmitted checksum of 0x0000 indicates that the checksum was disabled and not calculated.
• Mandatory in IPv6: While UDP checksums are optional in IPv4, they are strictly mandatory in IPv6 because the IPv6 base header lacks its own header checksum.

Receiver Verification

When the destination host receives the datagram, it constructs the same pseudo-header and adds all 16-bit words together, including the received checksum value in the UDP header.

If no transmission errors occurred, the resulting one’s complement sum will evaluate to 0xFFFF (or 0x0000 after inversion). Any other result indicates packet corruption, causing the receiving stack to discard the datagram.