Repair the checksums that cover changed bytes
04Address and port changes affect different checksum coverage. A pseudo-header includes IP addresses in TCP/UDP checksum calculations.
Separate Echo query: Basic NAT changes only the IP address, leaving the ICMP checksum unchanged. NAPT changes query ID 7 to 40000 and therefore changes the ICMP checksum too.
Source for this drawing: RFC 3022 · Read RFC section 4.1 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Fix the covered bytes without inventing a checksum that was absent.
- Basic NAT changes the IPv4 header checksum and TCP/UDP checksums because their pseudo-headers include source and destination IP addresses. NAPT also changes the transport port and its checksum.
- The UDP checksum-zero exception applies to the checksum field: preserve zero when an IPv4 UDP sender omitted the checksum. NAPT can still translate the UDP port. RFC 768 specifies that a calculated checksum of zero is transmitted as all ones.
- An ICMP query checksum does not cover IP addresses. Basic NAT therefore need not change that ICMP checksum merely for an address rewrite; NAPT must correct it when changing the query identifier.
- Section 4.2 provides an incremental adjustment algorithm restricted to even offsets and even byte lengths. The worked helper instead recomputes complete supported headers/segments; a separate word-adjustment helper is tested against full recomputation.
- Checksums detect some corruption and are not authentication. Changing the packet and recomputing its unkeyed checksum does not add encryption or prove who sent it.
Four-digit checksum words in the drawing are hexadecimal, computed for the chosen payload bytes 01 02 03. Only unfragmented IPv4 without options and bounded TCP without options, UDP or ICMP Echo packets are serialized here. Rewriting addresses is separate from a router’s TTL decrement. Full checksum verification uses a whole segment; the ICMP-error chapter separately handles a truncated quoted prefix. Sources: RFC 3022 sections 4.1–4.2; RFCs 768, 792, 1071 and 1624 for checksum context.
Read the RFC section ↗