Editing one address and having to fix the checksums by hand is exactly where most quick capture edits go wrong. Does Frame Bench recalculate IP, TCP and UDP checksums automatically after an edit, with an option to keep a deliberately broken one for testing? A diff view between the original and edited frame would also make it easier to attach modified captures to bug reports with confidence.
Regarding your point "Does Frame Bench recalculate IP, TCP and UDP checksums automatically after an edit, with an option to keep a deliberately broken one for testing?". Yes, it does, and for other protocols too. It recomputes lengths and checksums after every edit, padding included. You may turn this auto computation off so that it doesn't auto-fix them, and instead fix them on a packet-by-packet basis, from the decoded packet or a centralized Health check window.
"A diff view between the original and edited frame would also make it easier to attach modified captures to bug reports with confidence." Currently, Frame Bench allows you to diff multiple different frames at the same time at the byte level and protocol semantics level, but not for the same frame (Byte diff of up to five frames. Export as HTML, Markdown or unified diff). We'll add the capability to “Compare with original” for the same frame, that's a good idea.
Additionally, Frame Bench supports a separate “Capture diff” window, comparing the loaded capture against another file.
Thank you, for your input. If you have any other questions, please let us know.
Being able to switch the auto fix off per packet is the part that matters for fuzzing, so that's good to know. The separate Capture diff window covers most bug report cases already. Compare with original on a single frame would close the last gap.
StackShortlist
Proof Over Promises.
Editing one address and having to fix the checksums by hand is exactly where most quick capture edits go wrong. Does Frame Bench recalculate IP, TCP and UDP checksums automatically after an edit, with an option to keep a deliberately broken one for testing? A diff view between the original and edited frame would also make it easier to attach modified captures to bug reports with confidence.