This is our old Q&A Site. Please post any new questions and answers at


I've currently got a problem where traffic is being delivered out of sequence over an MPLS link. The traffic is UDP and the only way that I can see the OOS packets is by the IP Identification field. However as the link is a WAN link and the problem is intermitent then there is a lot a lot of traffic to work through. Therefore does anyone now how to apply a display filter that will identify any OOS packets based on the IP Identification number?

Any thoughts appreciated.



asked 14 Jun '13, 03:36

Malcolm's gravatar image

accept rate: 0%

edited 15 Jun '13, 20:11

grahamb's gravatar image

grahamb ♦


Thanks for your responses. I used the CSV approach and exported it excel and then looked for differences and it worked really well.

Thanks again for your help.


(14 Jun '13, 08:36) Malcolm

If a supplied answer resolves your question can you please "accept" it by clicking the checkmark icon next to it. This highlights good answers for the benefit of subsequent users with the same or similar questions.

(14 Jun '13, 11:18) Kurt Knochner ♦

If I get you right, you want to have a display filter for packets having OOS IP ID right? I'm not aware of anything like that due to wireshark being unable to filter for something like " < (lastframe" or other conditional stuff.

As a quick workaround for those cases, I always filter for the source IP I'm interested in, apply a coloumn for IP ID in that case -> and export the whole bunch to a .csv file.

With this one you can use e.g. excel to quickly build a "delta" coloumn for IP IDs, displaying the difference to the line above and by that spot OOS very quickly.

permanent link

answered 14 Jun '13, 04:16

Landi's gravatar image

accept rate: 28%

A Lua script might be able to do that.

Or tshark with some cli-fu:

tshark -r <file> -R "udp.port==xxx" -T fields -e frame.number -e  |\
    awk --non-decimal-data '$1>1 && ($2<lastipid || $2+64512<lastipid) {printf "%d : %d (last %d)\n",$1,$2,lastipid} {lastipid=$2}'

Running this on an UDP trace I have results in output like this:

761 : 8441 (last 44316)
1430 : 18630 (last 44560)
1854 : 6376 (last 44796)
2658 : 45035 (last 58035)

Of course if you have multiple sessions in your trace, you either need to do some session housekeeping in awk or you can loop over all sessions with a little script.

permanent link

answered 14 Jun '13, 04:46

SYN-bit's gravatar image

SYN-bit ♦♦
accept rate: 20%

edited 14 Jun '13, 04:47

Either use one of the already mentioned methods (@Landi or @SYN-bit), or capture at both sides of the MPLS (you just need the IP header, not the full payload), then run tshark (command below) and compare the tshark output with diff (Linux) or WinMerge (OpenSource Windows tool).

tshark -nr site-a.pcap -T fields -e frame.number -e > site-a.txt
tshark -nr site-b.pcap -T fields -e frame.number -e > site-b.txt

Then compare the files site-a.txt and site-b.txt.

diff site-a.txt site-b.txt

Or use WinMerge on Windows.


permanent link

answered 14 Jun '13, 04:56

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
accept rate: 15%

edited 14 Jun '13, 06:28

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 14 Jun '13, 03:36

question was seen: 11,262 times

last updated: 15 Jun '13, 20:11

p​o​w​e​r​e​d by O​S​Q​A