IPv4 Header Checksum — Computation and Verification

The IPv4 checksum is a simple 16-bit one's-complement checksum used to detect corruption of the IP header only. It is computed by both the sender (to fill the Checksum field) and every receiver/router (to validate the packet).

What part of the packet is covered?

Only the IPv4 header (including the Checksum field itself, the Options field if present, and the Source/Destination addresses) is covered — the data/payload is NOT included.

Why only the header?

• The payload is already protected by the data-link layer FCS (e.g., CRC-32 in Ethernet) and, end-to-end, by the transport layer checksum (TCP/UDP). IP itself is connectionless and need only guarantee that the packet is routed to the correct destination with an intact header.
• Checking the whole packet at every router hop would be far too expensive; instead each hop re-validates the header (and the router must recompute the checksum anyway because the TTL field changes at every hop).

Sender procedure (checksum generation)

1. Set the Checksum field to 0 in the header.
2. Split the header into 16-bit words (if the header length is odd, pad the last byte with a zero byte).
3. Add all the 16-bit words using one's-complement (end-around carry) addition: whenever there is a carry out of bit 15, add it back into bit 0.
4. Take the one's complement (invert all bits) of the sum → this value is written into the Checksum field.

$$\text{Checksum} = \sim\left(\sum_{i=1}^{n} w_i\right)$$

where $w_i$ are the 16-bit words and $\sim$ denotes one's complement, with end-around carries.

Receiver procedure (verification)

1. Split the received header (Checksum field now included) into 16-bit words.
2. Add them all with one's-complement addition.
3. If the result is $\texttt{0xFFFF}$ (all ones), the header is accepted as error-free; any other value → the packet is silently discarded (IP reports errors only via ICMP, and never for the source host of a bad header).

Key property: because the checksum is one's-complement, any single-bit error (and any odd number of bit errors in many patterns) is detected; the one's-complement arithmetic is chosen so the computation is order-independent and can be done incrementally.

Are options included?

Yes. The IPv4 header length (IHL) field is variable (5 to 15 32-bit words), and the checksum covers the entire header, including any options — because the Options field lies inside the header, before the payload. Only the payload is excluded. (If options were not covered, an error in options such as the source-route or timestamp fields would go undetected.)

Note: if an image/numerical header is attached to the question, the general procedure above applies — pad to an even number of bytes, zero the checksum field, sum the 16-bit words with end-around carry, and complement.