the Internet checksum
Picture a cashier who, after ringing up a long receipt, adds all the prices together and writes the total at the bottom. Later, anyone can re-add the prices and compare to the written total; if they disagree, a number was copied wrong. The Internet checksum works the same way for data. The sender treats the data as a list of numbers, adds them up in a defined way, and sends that sum alongside. The receiver re-adds and compares.
The precise scheme used by IP, TCP, and UDP is the 16-bit one's-complement checksum. The data is chopped into 16-bit words; the sender adds them all together, wrapping any carry out of the top back into the bottom (one's-complement addition), then takes the complement (flips every bit) of that sum and stores it as the checksum field. The receiver adds up the same words plus the received checksum; if nothing changed, the result is all 1-bits, which the receiver recognizes as a pass. This is deliberately cheap to compute in software, which is why TCP and UDP, built in the operating system, use it.
Be honest about its strength. The Internet checksum catches all single-bit errors and many common patterns, but because addition lets errors cancel out, it can miss certain combinations — for example, a value going up in one word and down by the same amount in another. It is much weaker than a CRC of similar size and is meant only as a lightweight sanity check, on the assumption that the link layer below already ran a stronger check. It also provides ZERO protection against tampering: anyone who changes the data can simply recompute the checksum.
TCP and UDP each carry a 16-bit checksum field computed over the header and data (plus a small piece of the IP header). A receiver that recomputes the checksum and gets a mismatch silently discards the segment — for UDP, that usually means the application just never sees that datagram.
A mismatched checksum means quietly drop the segment; nobody is asked to resend at this layer.
A checksum detects accidental corruption, not malicious tampering — an attacker just recomputes it. It is weaker than a CRC of the same length and relies on the link layer below for the heavy lifting.