This is a static archive of our old Q&A Site. Please post any new questions and answers at

Lots of errors in trace


In the attached trace there are a lots of errors, which are not true. Some of them are below.

  1. Why does relative sequence numbers not work.
  2. Why does tcp.time_delta display values which are not at all true (#6).
  3. There are a lot of retransmission's and acked unseen segments which are also not true.
  4. why does filtering with stream indexes not work. Stream index 0 only has 443->24891 traffic.

asked 21 Jul '17, 01:00

soochi's gravatar image

accept rate: 0%


How was the capture made, i.e. on-host, tap, mirror or span port or something else?

(21 Jul '17, 01:57) grahamb ♦

it was made on different devices on the path. example by dumping on the firewall, dumping on LB, and also via mirror port... all of them shows the same errors.

(21 Jul '17, 02:01) soochi

If they show the same errors there's something with your capture platform. It is known that hardware offloading features may interfere with proper capturing of these protocol streams.

(21 Jul '17, 02:22) Jaap ♦

error in capture platforms from many different vendors? all at the same time and all for the same IP pair combinations. highly unlikely!

(21 Jul '17, 02:26) soochi

You never told how these captures were made, only where. It still can be the same laptop connected to different equipment in the network, either directly or via (possibly virtual) span or mirror.

(21 Jul '17, 04:36) Jaap ♦

One Answer:


Perhaps Wireshark is confused about which packets belong to which TCP connection. It looks as if packet 1 is the last packet of one TCP connection (an RST+ACK) and packet 2 is the initial SYN of a new TCP connection between the same endpoints (IP addresses+TCP ports), with packet 3 being the SYN+ACK, packet 4 being the ACK of the SYN+ACK, and packet 5 being the first data packet. That could cause various forms of confusion, including all of the symptoms reported above; stripping out the first packet seems to make at least some things work better.

Please file a bug on the Wireshark Bugzilla, with your capture attached to it.

answered 21 Jul '17, 02:41

Guy%20Harris's gravatar image

Guy Harris ♦♦
accept rate: 19%