This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Out of Order packets

0

Hello, I know that out of order packets have been discussed many times, but I still think there should be some way to reorder packets based on sequence and ack numbers only to make it easier to see if all packets were sent and received, and then how many were retransmitted. Yes, looking at the FINs, the following ACKs, and RSTs can be a quick way to see if all packets were sent and received, but it is sometimes painfully difficult to go up and down looking at each packet's sequence and ack numbers.

Tcpdumps from firewalls and loadbalancers are always saved out of order, and worse, the orders do not match each other. This makes large captures difficult to troubleshoot by having to ignore the Wireshark warning messages about previous segment lost and acking unseen segment. Then, look at each packet up and down trying to piece together what was sent and received.

A wireshark menu option to reorder packets from the display filter based on sequence and ack numbers would be the best improvement ever.

Thanks, Tom

asked 08 Nov '15, 05:36

TomF's gravatar image

TomF
6112
accept rate: 0%

Do you want to be able to save a pcap with out-of-order packets into a new pcap with the packets in order (timestamp of packets may not be in order as a result) and all retransmitted packets removed?

(08 Nov '15, 05:50) pktUser1001

One Answer:

1

Tcpdumps from firewalls and loadbalancers are always saved out of order, and worse, the orders do not match each other.

I know that problem well and as you said, sometimes it makes troubleshooting harder.

Then, look at each packet up and down trying to piece together what was sent and received.

You can add a column for the IP ID (ip.id) and/or SEQ (tcp.seq) and sort the capture file according to the values of one of these columns. It will break the 'flow' of a session (req/resp), but at least it will help to compare two capture files (taken on the firewall and/or the loadbalancer).

A wireshark menu option to reorder packets from the display filter based on sequence and ack numbers would be the best improvement ever.

Please add a feature request to the Wireshark bug tracker.

https://bugs.wireshark.org

Regards
Kurt

answered 08 Nov '15, 07:55

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Hello Kurt, Many thanks. Adding a column for Custom(tcp.seq) is a good workaround and will help.

Thanks, Tom

(08 Nov '15, 19:37) TomF

good!

Hint: If a supplied answer resolves your question can you please "accept" it by clicking the checkmark icon next to it. This highlights good answers for the benefit of subsequent users with the same or similar questions. For extra points you can up vote the answer (thumb up).

(09 Nov '15, 14:47) Kurt Knochner ♦