title: How could I guess a checksum algorithm?
body: <p>Let's assume that I have some packets with a 16-bit checksum at the end. I would like to guess which checksum algorithm is used.</p>
  
  <p>For a start, from dump data I can see that one byte change in the packet's payload totally changes the checksum, so I can assume that it isn't some kind of simple XOR or sum.</p>
  
  <p>Then I tried <a href="http://svn.rot13.org/index.cgi/RFID/view/guess-crc.pl" rel="noreferrer">several variations of CRC16</a>, but without much luck.</p>
  
  <p>This question might be more biased towards cryptography, but I'm really interested in any easy to understand statistical tools to find out which CRC this might be. I might even turn to <a href="http://lcamtuf.coredump.cx/newtcp/" rel="noreferrer">drawing different CRC algorithms</a> if everything else fails.</p>
  
  <p>Backgroud story: I have serial RFID protocol with some kind of checksum. I can replay messages without problem, and interpret results (without checksum check), but I can't send modified packets because device drops them on the floor. </p>
  
  <p>Using existing software, I can change payload of RFID chip. However, unique serial number is immutable, so I don't have ability to check every possible combination. Allthough I could generate dumps of values incrementing by one, but not enough to make exhaustive search applicable to this problem.</p>
  
  <p><a href="http://www.bljak.org/~dpavlin/rfid-serial-dump.tar.gz" rel="noreferrer">dump files with data</a> are available if question itself isn't enough :-)</p>
  
  <p><strong>Need reference documentation?</strong> <a href="http://www.geocities.com/SiliconValley/Pines/8659/crc.htm" rel="noreferrer">A PAINLESS GUIDE TO CRC ERROR DETECTION ALGORITHMS</a> is great reference which I found after asking question here.</p>
  
  <p>In the end, after very helpful hint in accepted answer than it's CCITT, I
  <a href="http://www.zorc.breitbandkatze.de/crc.html" rel="noreferrer">used this CRC calculator</a>, and xored generated checksum with known checksum to get 0xffff which led me to conclusion that final xor is 0xffff instread of CCITT's 0x0000.</p>