When you download a large file from the internet, transfer a critical backup across a network, or burn an ISO image to a USB drive, there is always a slight risk that the data could become corrupted during transit. A dropped packet or a minor hardware glitch might alter a few bytes of data, rendering an operating system installer unbootable or a database archive useless. To verify that a file transferred perfectly and is 100% identical to the original source, you must use a checksum. In Linux, one of the oldest (though arguably outdated) tools for this job is the sum command.
What is a Checksum?
A checksum is a unique mathematical string (a hash) generated by running an algorithm against the exact binary contents of a file. If even a single 1 or 0 inside the file is changed, the resulting checksum will be completely different. By generating a checksum on your local machine and comparing it to the checksum provided by the server you downloaded it from, you can definitively prove the file’s integrity.
Using the sum Command
The sum command reads a file and outputs a basic checksum along with the total number of blocks in the file. To use it, simply type the command followed by the file path:
sum ubuntu-installer.isoThe output will consist of two numbers, for example:
32049 1536000- 32049: This is the actual checksum value.
- 1536000: This is the number of 1KB data blocks in the file.
If you transferred this ISO to another server, you would run sum on the destination file. If the output matches exactly, the file transferred successfully without corruption.
Important Security Warning Regarding sum
While the sum command is useful for quick, casual checks against accidental network corruption, it should never be used for security verification.
The sum utility uses incredibly old, simplistic hashing algorithms (either a basic 16-bit BSD algorithm or a System V algorithm depending on flags). Because these algorithms are so weak, it is trivial for a malicious attacker to inject a virus into a file and artificially pad it so that it produces the exact same 16-bit checksum as the original, safe file (a “hash collision”).
If you are verifying the integrity of security certificates, encrypted data, or official Linux ISO downloads, you should ignore the sum command entirely and use modern, cryptographically secure hashing tools like sha256sum or sha512sum instead.