Tool 11: Sniff and verify checksums
  
  Description:
   
  This tool sniffs and verify checksums (IP header, TCP, UDP, etc.).
  If a bad checksum is encountered, it is displayed along with the
  expected value.
  
  Parameter --device indicates on which device to sniff. Please note
  that under some systems, such as Windows, sniffing on some devices is
  not supported.
  Parameter --filter defines the sniff filter. It permits to restrict
  captured packets. This kind of filter is named a BPF or pcap filter.
  Basic elements of a filter are:
    host 1.2.3.4
    net 192.168.10
    net 192.168.10.0 mask 255.255.255.0
    net 192.168.10.0/24
    port 21
    dst host 1.2.3.4
    src port 2345
    ether host a:b:c:d:e:f ('ether a:b:c:d:e:f' is not working)
    ether src aa:bb:cc:dd:ee:ff
    ip
    arp
    rarp
    tcp
    icmp
    udp
  Here are filter examples:
    "host 1.2.3.4"
    "net 192.168 and icmp"
    "host 1.2.3.4 or dst port 80"
    "(udp or tcp) and not host 1.2.3.4"
  Parameter --rawip indicates to ignore Ethernet/link layer, and start
  displaying at IP header.
  Parameter --ipreas tries to reassemble IP packets. This might miss
  packets.
  
  This tool may need to be run with admin privilege in order to sniff.
   
  Synonyms:
    capture
  Usage:
    netwox 11 [-d device] [-f filter] [-r|+r] [-i|+i]
  Parameters:
 
  | parameter | description | example | 
 | -d|--device device | device name | Eth0 | 
| -f|--filter filter | pcap filter |  | 
| -r|--rawip|+r|--no-rawip | sniff at IP level |  | 
| -i|--ipreas|+i|--no-ipreas | reassemble IP packets |  | 
  Example:
    netwox 11