Why does the checksum remain unverified?

UDP bytes do not contain IP addresses. Supply both addresses so the parser can construct the required pseudo-header.

Can I paste a full Ethernet packet?

Remove its Ethernet and IP headers first. UDP input starts with the two-byte source port and ends at its declared length.

Does zero mean a valid UDP checksum?

IPv4 uses zero to indicate an absent checksum. The parser rejects zero as a valid ordinary IPv6 UDP checksum.

UDP Parser | Tool Factory

Tool workspace

Packet bytes stay in this browser. Checksum checks use only the addresses you enter.

Needs input

Run the tool when your input is ready.

Packet bytes

Paste exactly one UDP datagram, starting with its source port. Remove Ethernet and IP headers.

Options

Input format

Source IP

Optional checksum context. Enter the source IPv4 or IPv6 address from the packet.

Destination IP

Enter the final destination address. Both addresses must use the same IP version.

Your result appears here

Parse UDP ports, length, checksum, and payload. Check IPv4 or IPv6 checksums with packet addresses and inspect every header offset.

This tool runs open-source code from CyberChef by GCHQ (Apache License 2.0). See open-source credits.

UDP Parser reads source port, destination port, length, checksum, and payload from hexadecimal bytes. The UDP header occupies eight bytes. Its length includes both header and payload. Supply the packet's source and destination IP addresses to check its checksum. The byte table shows each field's offset, original bytes, and meaning.

The JSON preserves payload bytes as hexadecimal text. Checksum check shows the expected checksum and the exact pseudo-header bytes.

Check whether a UDP capture ends before its declared payload length.
Separate a datagram's port numbers from its application bytes.
Recalculate a captured checksum with the original IP addresses.

Sources: RFC 768: UDP fields and checksum; RFC 8200 section 8.1: IPv6 checksums

Instructions

Copy the UDP bytes from a packet capture. Start with the source port, after any Ethernet and IP headers.
Choose Hex for byte pairs. Choose Raw only for text whose characters directly represent Latin1 byte values.
Enter both IP addresses from the packet for checksum verification. Keep both fields blank when those addresses are unknown.
Select Parse bytes. Compare Length with the supplied byte count, then inspect Checksum check and the field table.
Select Run working sample to inspect an eleven-byte datagram with three payload bytes and a valid IPv4 checksum.

Example

Input: 30 39 00 35 00 0b 1e d0 61 62 63

Settings: Input format: Hex; Source IP: 192.0.2.1; Destination IP: 198.51.100.2.

Result: { "Source port": 12345, "Destination port": 53, "Length": 11, "Checksum": "0x1ed0", "Checksum check": { "status": "Valid", "expected": "0x1ed0", "IP version": 4, "Pseudo-header": "c0000201c63364020011000b" }, "Data": "616263" }

This hand-worked datagram carries 61 62 63. Its checksum includes the IPv4 pseudo-header and an arithmetic padding byte.

Limits

Paste exactly one datagram. Extra bytes, incomplete headers, and inconsistent lengths cause errors.
IPv4 permits an absent UDP checksum encoded as zero. IPv6 normally requires a nonzero UDP checksum.
The parser reports zero IPv6 checksums as invalid. It does not implement specialized tunnel exceptions or IPv6 jumbograms.
A checksum mismatch can reflect capture offload, wrong addresses, or corruption. It does not identify the cause.
The parser accepts at most 65535 bytes. It does not reassemble IP fragments or decode DNS, DHCP, or other applications.